Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

Pull networking updates from David Miller:

 1) More iov_iter conversion work from Al Viro.

    [ The "crypto: switch af_alg_make_sg() to iov_iter" commit was
      wrong, and this pull actually adds an extra commit on top of the
      branch I'm pulling to fix that up, so that the pre-merge state is
      ok.   - Linus ]

 2) Various optimizations to the ipv4 forwarding information base trie
    lookup implementation.  From Alexander Duyck.

 3) Remove sock_iocb altogether, from CHristoph Hellwig.

 4) Allow congestion control algorithm selection via routing metrics.
    From Daniel Borkmann.

 5) Make ipv4 uncached route list per-cpu, from Eric Dumazet.

 6) Handle rfs hash collisions more gracefully, also from Eric Dumazet.

 7) Add xmit_more support to r8169, e1000, and e1000e drivers.  From
    Florian Westphal.

 8) Transparent Ethernet Bridging support for GRO, from Jesse Gross.

 9) Add BPF packet actions to packet scheduler, from Jiri Pirko.

10) Add support for uniqu flow IDs to openvswitch, from Joe Stringer.

11) New NetCP ethernet driver, from Muralidharan Karicheri and Wingman
    Kwok.

12) More sanely handle out-of-window dupacks, which can result in
    serious ACK storms.  From Neal Cardwell.

13) Various rhashtable bug fixes and enhancements, from Herbert Xu,
    Patrick McHardy, and Thomas Graf.

14) Support xmit_more in be2net, from Sathya Perla.

15) Group Policy extensions for vxlan, from Thomas Graf.

16) Remove Checksum Offload support for vxlan, from Tom Herbert.

17) Like ipv4, support lockless transmit over ipv6 UDP sockets.  From
    Vlad Yasevich.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1494+1 commits)
  crypto: fix af_alg_make_sg() conversion to iov_iter
  ipv4: Namespecify TCP PMTU mechanism
  i40e: Fix for stats init function call in Rx setup
  tcp: don't include Fast Open option in SYN-ACK on pure SYN-data
  openvswitch: Only set TUNNEL_VXLAN_OPT if VXLAN-GBP metadata is set
  ipv6: Make __ipv6_select_ident static
  ipv6: Fix fragment id assignment on LE arches.
  bridge: Fix inability to add non-vlan fdb entry
  net: Mellanox: Delete unnecessary checks before the function call "vunmap"
  cxgb4: Add support in cxgb4 to get expansion rom version via ethtool
  ethtool: rename reserved1 memeber in ethtool_drvinfo for expansion ROM version
  net: dsa: Remove redundant phy_attach()
  IB/mlx4: Reset flow support for IB kernel ULPs
  IB/mlx4: Always use the correct port for mirrored multicast attachments
  net/bonding: Fix potential bad memory access during bonding events
  tipc: remove tipc_snprintf
  tipc: nl compat add noop and remove legacy nl framework
  tipc: convert legacy nl stats show to nl compat
  tipc: convert legacy nl net id get to nl compat
  tipc: convert legacy nl net id set to nl compat
  ...

339 files changed, 20462 insertions, 6641 deletions

diff --git a/drivers/net/wireless/adm8211.c b/drivers/net/wireless/adm8211.c
index 17fcaabb2687..f07a61899545 100644
--- a/drivers/net/wireless/adm8211.c
+++ b/drivers/net/wireless/adm8211.c
@@ -1837,6 +1837,7 @@ static int adm8211_probe(struct pci_dev *pdev,
         if (!priv->map) {
                 printk(KERN_ERR "%s (adm8211): Cannot map device memory\n",
                        pci_name(pdev));
+                err = -ENOMEM;
                 goto err_free_dev;
         }
 
diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
index ccba4fea7269..1eebe2ea3dfb 100644
--- a/drivers/net/wireless/ath/ath.h
+++ b/drivers/net/wireless/ath/ath.h
@@ -64,6 +64,7 @@ enum ath_op_flags {
         ATH_OP_HW_RESET,
         ATH_OP_SCANNING,
         ATH_OP_MULTI_CHANNEL,
+        ATH_OP_WOW_ENABLED,
 };
 
 enum ath_bus_type {
diff --git a/drivers/net/wireless/ath/ath10k/Makefile b/drivers/net/wireless/ath/ath10k/Makefile
index 8b1b1adb477a..f4dbb3e93bf8 100644
--- a/drivers/net/wireless/ath/ath10k/Makefile
+++ b/drivers/net/wireless/ath/ath10k/Makefile
@@ -8,11 +8,15 @@ ath10k_core-y += mac.o \
                  htt_tx.o \
                  txrx.o \
                  wmi.o \
-                 bmi.o
+                 wmi-tlv.o \
+                 bmi.o \
+                 hw.o
 
 ath10k_core-$(CONFIG_ATH10K_DEBUGFS) += spectral.o
 ath10k_core-$(CONFIG_NL80211_TESTMODE) += testmode.o
 ath10k_core-$(CONFIG_ATH10K_TRACING) += trace.o
+ath10k_core-$(CONFIG_THERMAL) += thermal.o
+ath10k_core-$(CONFIG_MAC80211_DEBUGFS) += debugfs_sta.o
 
 obj-$(CONFIG_ATH10K_PCI) += ath10k_pci.o
 ath10k_pci-y += pci.o \
diff --git a/drivers/net/wireless/ath/ath10k/ce.c b/drivers/net/wireless/ath/ath10k/ce.c
index a156e6e48708..e508c65b6ba8 100644
--- a/drivers/net/wireless/ath/ath10k/ce.c
+++ b/drivers/net/wireless/ath/ath10k/ce.c
@@ -803,7 +803,7 @@ int ath10k_ce_disable_interrupts(struct ath10k *ar)
         int ce_id;
 
         for (ce_id = 0; ce_id < CE_COUNT; ce_id++) {
-                u32 ctrl_addr = ath10k_ce_base_address(ce_id);
+                u32 ctrl_addr = ath10k_ce_base_address(ar, ce_id);
 
                 ath10k_ce_copy_complete_intr_disable(ar, ctrl_addr);
                 ath10k_ce_error_intr_disable(ar, ctrl_addr);
@@ -832,7 +832,7 @@ static int ath10k_ce_init_src_ring(struct ath10k *ar,
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         struct ath10k_ce_pipe *ce_state = &ar_pci->ce_states[ce_id];
         struct ath10k_ce_ring *src_ring = ce_state->src_ring;
-        u32 nentries, ctrl_addr = ath10k_ce_base_address(ce_id);
+        u32 nentries, ctrl_addr = ath10k_ce_base_address(ar, ce_id);
 
         nentries = roundup_pow_of_two(attr->src_nentries);
 
@@ -869,7 +869,7 @@ static int ath10k_ce_init_dest_ring(struct ath10k *ar,
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         struct ath10k_ce_pipe *ce_state = &ar_pci->ce_states[ce_id];
         struct ath10k_ce_ring *dest_ring = ce_state->dest_ring;
-        u32 nentries, ctrl_addr = ath10k_ce_base_address(ce_id);
+        u32 nentries, ctrl_addr = ath10k_ce_base_address(ar, ce_id);
 
         nentries = roundup_pow_of_two(attr->dest_nentries);
 
@@ -1051,7 +1051,7 @@ int ath10k_ce_init_pipe(struct ath10k *ar, unsigned int ce_id,
 
 static void ath10k_ce_deinit_src_ring(struct ath10k *ar, unsigned int ce_id)
 {
-        u32 ctrl_addr = ath10k_ce_base_address(ce_id);
+        u32 ctrl_addr = ath10k_ce_base_address(ar, ce_id);
 
         ath10k_ce_src_ring_base_addr_set(ar, ctrl_addr, 0);
         ath10k_ce_src_ring_size_set(ar, ctrl_addr, 0);
@@ -1061,7 +1061,7 @@ static void ath10k_ce_deinit_src_ring(struct ath10k *ar, unsigned int ce_id)
 
 static void ath10k_ce_deinit_dest_ring(struct ath10k *ar, unsigned int ce_id)
 {
-        u32 ctrl_addr = ath10k_ce_base_address(ce_id);
+        u32 ctrl_addr = ath10k_ce_base_address(ar, ce_id);
 
         ath10k_ce_dest_ring_base_addr_set(ar, ctrl_addr, 0);
         ath10k_ce_dest_ring_size_set(ar, ctrl_addr, 0);
@@ -1093,10 +1093,12 @@ int ath10k_ce_alloc_pipe(struct ath10k *ar, int ce_id,
                      (CE_HTT_H2T_MSG_SRC_NENTRIES - 1));
         BUILD_BUG_ON(2*TARGET_10X_NUM_MSDU_DESC >
                      (CE_HTT_H2T_MSG_SRC_NENTRIES - 1));
+        BUILD_BUG_ON(2*TARGET_TLV_NUM_MSDU_DESC >
+                     (CE_HTT_H2T_MSG_SRC_NENTRIES - 1));
 
         ce_state->ar = ar;
         ce_state->id = ce_id;
-        ce_state->ctrl_addr = ath10k_ce_base_address(ce_id);
+        ce_state->ctrl_addr = ath10k_ce_base_address(ar, ce_id);
         ce_state->attr_flags = attr->flags;
         ce_state->src_sz_max = attr->src_sz_max;
 
diff --git a/drivers/net/wireless/ath/ath10k/ce.h b/drivers/net/wireless/ath/ath10k/ce.h
index 617a151e8ce4..c18647b87f71 100644
--- a/drivers/net/wireless/ath/ath10k/ce.h
+++ b/drivers/net/wireless/ath/ath10k/ce.h
@@ -394,7 +394,7 @@ struct ce_attr {
 #define DST_WATERMARK_HIGH_RESET                0
 #define DST_WATERMARK_ADDRESS                   0x0050
 
-static inline u32 ath10k_ce_base_address(unsigned int ce_id)
+static inline u32 ath10k_ce_base_address(struct ath10k *ar, unsigned int ce_id)
 {
         return CE0_BASE_ADDRESS + (CE1_BASE_ADDRESS - CE0_BASE_ADDRESS) * ce_id;
 }
diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
index 7762061a1944..310e12bc078a 100644
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -17,6 +17,7 @@
 
 #include <linux/module.h>
 #include <linux/firmware.h>
+#include <linux/of.h>
 
 #include "core.h"
 #include "mac.h"
@@ -27,20 +28,18 @@
 #include "debug.h"
 #include "htt.h"
 #include "testmode.h"
+#include "wmi-ops.h"
 
 unsigned int ath10k_debug_mask;
 static bool uart_print;
-static unsigned int ath10k_p2p;
 static bool skip_otp;
 
 module_param_named(debug_mask, ath10k_debug_mask, uint, 0644);
 module_param(uart_print, bool, 0644);
-module_param_named(p2p, ath10k_p2p, uint, 0644);
 module_param(skip_otp, bool, 0644);
 
 MODULE_PARM_DESC(debug_mask, "Debugging mask");
 MODULE_PARM_DESC(uart_print, "Uart target debugging");
-MODULE_PARM_DESC(p2p, "Enable ath10k P2P support");
 MODULE_PARM_DESC(skip_otp, "Skip otp failure for calibration in testmode");
 
 static const struct ath10k_hw_params ath10k_hw_params_list[] = {
@@ -48,11 +47,57 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
                 .id = QCA988X_HW_2_0_VERSION,
                 .name = "qca988x hw2.0",
                 .patch_load_addr = QCA988X_HW_2_0_PATCH_LOAD_ADDR,
+                .uart_pin = 7,
                 .fw = {
                         .dir = QCA988X_HW_2_0_FW_DIR,
                         .fw = QCA988X_HW_2_0_FW_FILE,
                         .otp = QCA988X_HW_2_0_OTP_FILE,
                         .board = QCA988X_HW_2_0_BOARD_DATA_FILE,
+                        .board_size = QCA988X_BOARD_DATA_SZ,
+                        .board_ext_size = QCA988X_BOARD_EXT_DATA_SZ,
+                },
+        },
+        {
+                .id = QCA6174_HW_2_1_VERSION,
+                .name = "qca6174 hw2.1",
+                .patch_load_addr = QCA6174_HW_2_1_PATCH_LOAD_ADDR,
+                .uart_pin = 6,
+                .fw = {
+                        .dir = QCA6174_HW_2_1_FW_DIR,
+                        .fw = QCA6174_HW_2_1_FW_FILE,
+                        .otp = QCA6174_HW_2_1_OTP_FILE,
+                        .board = QCA6174_HW_2_1_BOARD_DATA_FILE,
+                        .board_size = QCA6174_BOARD_DATA_SZ,
+                        .board_ext_size = QCA6174_BOARD_EXT_DATA_SZ,
+                },
+        },
+        {
+                .id = QCA6174_HW_3_0_VERSION,
+                .name = "qca6174 hw3.0",
+                .patch_load_addr = QCA6174_HW_3_0_PATCH_LOAD_ADDR,
+                .uart_pin = 6,
+                .fw = {
+                        .dir = QCA6174_HW_3_0_FW_DIR,
+                        .fw = QCA6174_HW_3_0_FW_FILE,
+                        .otp = QCA6174_HW_3_0_OTP_FILE,
+                        .board = QCA6174_HW_3_0_BOARD_DATA_FILE,
+                        .board_size = QCA6174_BOARD_DATA_SZ,
+                        .board_ext_size = QCA6174_BOARD_EXT_DATA_SZ,
+                },
+        },
+        {
+                .id = QCA6174_HW_3_2_VERSION,
+                .name = "qca6174 hw3.2",
+                .patch_load_addr = QCA6174_HW_3_0_PATCH_LOAD_ADDR,
+                .uart_pin = 6,
+                .fw = {
+                        /* uses same binaries as hw3.0 */
+                        .dir = QCA6174_HW_3_0_FW_DIR,
+                        .fw = QCA6174_HW_3_0_FW_FILE,
+                        .otp = QCA6174_HW_3_0_OTP_FILE,
+                        .board = QCA6174_HW_3_0_BOARD_DATA_FILE,
+                        .board_size = QCA6174_BOARD_DATA_SZ,
+                        .board_ext_size = QCA6174_BOARD_EXT_DATA_SZ,
                 },
         },
 };
@@ -146,8 +191,8 @@ static const struct firmware *ath10k_fetch_fw_file(struct ath10k *ar,
 static int ath10k_push_board_ext_data(struct ath10k *ar, const void *data,
                                       size_t data_len)
 {
-        u32 board_data_size = QCA988X_BOARD_DATA_SZ;
-        u32 board_ext_data_size = QCA988X_BOARD_EXT_DATA_SZ;
+        u32 board_data_size = ar->hw_params.fw.board_size;
+        u32 board_ext_data_size = ar->hw_params.fw.board_ext_size;
         u32 board_ext_data_addr;
         int ret;
 
@@ -193,7 +238,7 @@ static int ath10k_push_board_ext_data(struct ath10k *ar, const void *data,
 static int ath10k_download_board_data(struct ath10k *ar, const void *data,
                                       size_t data_len)
 {
-        u32 board_data_size = QCA988X_BOARD_DATA_SZ;
+        u32 board_data_size = ar->hw_params.fw.board_size;
         u32 address;
         int ret;
 
@@ -249,6 +294,63 @@ static int ath10k_download_cal_file(struct ath10k *ar)
         return 0;
 }
 
+static int ath10k_download_cal_dt(struct ath10k *ar)
+{
+        struct device_node *node;
+        int data_len;
+        void *data;
+        int ret;
+
+        node = ar->dev->of_node;
+        if (!node)
+                /* Device Tree is optional, don't print any warnings if
+                 * there's no node for ath10k.
+                 */
+                return -ENOENT;
+
+        if (!of_get_property(node, "qcom,ath10k-calibration-data",
+                             &data_len)) {
+                /* The calibration data node is optional */
+                return -ENOENT;
+        }
+
+        if (data_len != QCA988X_CAL_DATA_LEN) {
+                ath10k_warn(ar, "invalid calibration data length in DT: %d\n",
+                            data_len);
+                ret = -EMSGSIZE;
+                goto out;
+        }
+
+        data = kmalloc(data_len, GFP_KERNEL);
+        if (!data) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        ret = of_property_read_u8_array(node, "qcom,ath10k-calibration-data",
+                                        data, data_len);
+        if (ret) {
+                ath10k_warn(ar, "failed to read calibration data from DT: %d\n",
+                            ret);
+                goto out_free;
+        }
+
+        ret = ath10k_download_board_data(ar, data, data_len);
+        if (ret) {
+                ath10k_warn(ar, "failed to download calibration data from Device Tree: %d\n",
+                            ret);
+                goto out_free;
+        }
+
+        ret = 0;
+
+out_free:
+        kfree(data);
+
+out:
+        return ret;
+}
+
 static int ath10k_download_and_run_otp(struct ath10k *ar)
 {
         u32 result, address = ar->hw_params.patch_load_addr;
@@ -447,7 +549,7 @@ static int ath10k_core_fetch_firmware_api_n(struct ath10k *ar, const char *name)
         int ie_id, i, index, bit, ret;
         struct ath10k_fw_ie *hdr;
         const u8 *data;
-        __le32 *timestamp;
+        __le32 *timestamp, *version;
 
         /* first fetch the firmware file (firmware-*.bin) */
         ar->firmware = ath10k_fetch_fw_file(ar, ar->hw_params.fw.dir, name);
@@ -562,6 +664,17 @@ static int ath10k_core_fetch_firmware_api_n(struct ath10k *ar, const char *name)
                         ar->otp_len = ie_len;
 
                         break;
+                case ATH10K_FW_IE_WMI_OP_VERSION:
+                        if (ie_len != sizeof(u32))
+                                break;
+
+                        version = (__le32 *)data;
+
+                        ar->wmi.op_version = le32_to_cpup(version);
+
+                        ath10k_dbg(ar, ATH10K_DBG_BOOT, "found fw ie wmi op version %d\n",
+                                   ar->wmi.op_version);
+                        break;
                 default:
                         ath10k_warn(ar, "Unknown FW IE: %u\n",
                                     le32_to_cpu(hdr->id));
@@ -582,13 +695,6 @@ static int ath10k_core_fetch_firmware_api_n(struct ath10k *ar, const char *name)
                 goto err;
         }
 
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10_2, ar->fw_features) &&
-            !test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                ath10k_err(ar, "feature bits corrupted: 10.2 feature requires 10.x feature to be set as well");
-                ret = -EINVAL;
-                goto err;
-        }
-
         /* now fetch the board file */
         if (ar->hw_params.fw.board == NULL) {
                 ath10k_err(ar, "board data file not defined");
@@ -624,6 +730,13 @@ static int ath10k_core_fetch_firmware_files(struct ath10k *ar)
         /* calibration file is optional, don't check for any errors */
         ath10k_fetch_cal_file(ar);
 
+        ar->fw_api = 4;
+        ath10k_dbg(ar, ATH10K_DBG_BOOT, "trying fw api %d\n", ar->fw_api);
+
+        ret = ath10k_core_fetch_firmware_api_n(ar, ATH10K_FW_API4_FILE);
+        if (ret == 0)
+                goto success;
+
         ar->fw_api = 3;
         ath10k_dbg(ar, ATH10K_DBG_BOOT, "trying fw api %d\n", ar->fw_api);
 
@@ -662,7 +775,17 @@ static int ath10k_download_cal_data(struct ath10k *ar)
         }
 
         ath10k_dbg(ar, ATH10K_DBG_BOOT,
-                   "boot did not find a calibration file, try OTP next: %d\n",
+                   "boot did not find a calibration file, try DT next: %d\n",
+                   ret);
+
+        ret = ath10k_download_cal_dt(ar);
+        if (ret == 0) {
+                ar->cal_mode = ATH10K_CAL_MODE_DT;
+                goto done;
+        }
+
+        ath10k_dbg(ar, ATH10K_DBG_BOOT,
+                   "boot did not find DT entry, try OTP next: %d\n",
                    ret);
 
         ret = ath10k_download_and_run_otp(ar);
@@ -696,7 +819,7 @@ static int ath10k_init_uart(struct ath10k *ar)
         if (!uart_print)
                 return 0;
 
-        ret = ath10k_bmi_write32(ar, hi_dbg_uart_txpin, 7);
+        ret = ath10k_bmi_write32(ar, hi_dbg_uart_txpin, ar->hw_params.uart_pin);
         if (ret) {
                 ath10k_warn(ar, "could not enable UART prints (%d)\n", ret);
                 return ret;
@@ -764,6 +887,7 @@ static void ath10k_core_restart(struct work_struct *work)
         complete_all(&ar->offchan_tx_completed);
         complete_all(&ar->install_key_done);
         complete_all(&ar->vdev_setup_done);
+        complete_all(&ar->thermal.wmi_sync);
         wake_up(&ar->htt.empty_tx_wq);
         wake_up(&ar->wmi.tx_credits_wq);
         wake_up(&ar->peer_mapping_wq);
@@ -799,15 +923,63 @@ static void ath10k_core_restart(struct work_struct *work)
         mutex_unlock(&ar->conf_mutex);
 }
 
-static void ath10k_core_init_max_sta_count(struct ath10k *ar)
+static int ath10k_core_init_firmware_features(struct ath10k *ar)
 {
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                ar->max_num_peers = TARGET_10X_NUM_PEERS;
-                ar->max_num_stations = TARGET_10X_NUM_STATIONS;
-        } else {
+        if (test_bit(ATH10K_FW_FEATURE_WMI_10_2, ar->fw_features) &&
+            !test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
+                ath10k_err(ar, "feature bits corrupted: 10.2 feature requires 10.x feature to be set as well");
+                return -EINVAL;
+        }
+
+        if (ar->wmi.op_version >= ATH10K_FW_WMI_OP_VERSION_MAX) {
+                ath10k_err(ar, "unsupported WMI OP version (max %d): %d\n",
+                           ATH10K_FW_WMI_OP_VERSION_MAX, ar->wmi.op_version);
+                return -EINVAL;
+        }
+
+        /* Backwards compatibility for firmwares without
+         * ATH10K_FW_IE_WMI_OP_VERSION.
+         */
+        if (ar->wmi.op_version == ATH10K_FW_WMI_OP_VERSION_UNSET) {
+                if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
+                        if (test_bit(ATH10K_FW_FEATURE_WMI_10_2,
+                                     ar->fw_features))
+                                ar->wmi.op_version = ATH10K_FW_WMI_OP_VERSION_10_2;
+                        else
+                                ar->wmi.op_version = ATH10K_FW_WMI_OP_VERSION_10_1;
+                } else {
+                        ar->wmi.op_version = ATH10K_FW_WMI_OP_VERSION_MAIN;
+                }
+        }
+
+        switch (ar->wmi.op_version) {
+        case ATH10K_FW_WMI_OP_VERSION_MAIN:
                 ar->max_num_peers = TARGET_NUM_PEERS;
                 ar->max_num_stations = TARGET_NUM_STATIONS;
+                ar->max_num_vdevs = TARGET_NUM_VDEVS;
+                ar->htt.max_num_pending_tx = TARGET_NUM_MSDU_DESC;
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_10_1:
+        case ATH10K_FW_WMI_OP_VERSION_10_2:
+        case ATH10K_FW_WMI_OP_VERSION_10_2_4:
+                ar->max_num_peers = TARGET_10X_NUM_PEERS;
+                ar->max_num_stations = TARGET_10X_NUM_STATIONS;
+                ar->max_num_vdevs = TARGET_10X_NUM_VDEVS;
+                ar->htt.max_num_pending_tx = TARGET_10X_NUM_MSDU_DESC;
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_TLV:
+                ar->max_num_peers = TARGET_TLV_NUM_PEERS;
+                ar->max_num_stations = TARGET_TLV_NUM_STATIONS;
+                ar->max_num_vdevs = TARGET_TLV_NUM_VDEVS;
+                ar->htt.max_num_pending_tx = TARGET_TLV_NUM_MSDU_DESC;
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_UNSET:
+        case ATH10K_FW_WMI_OP_VERSION_MAX:
+                WARN_ON(1);
+                return -EINVAL;
         }
+
+        return 0;
 }
 
 int ath10k_core_start(struct ath10k *ar, enum ath10k_firmware_mode mode)
@@ -932,6 +1104,18 @@ int ath10k_core_start(struct ath10k *ar, enum ath10k_firmware_mode mode)
                 goto err_hif_stop;
         }
 
+        /* If firmware indicates Full Rx Reorder support it must be used in a
+         * slightly different manner. Let HTT code know.
+         */
+        ar->htt.rx_ring.in_ord_rx = !!(test_bit(WMI_SERVICE_RX_FULL_REORDER,
+                                                ar->wmi.svc_map));
+
+        status = ath10k_htt_rx_ring_refill(ar);
+        if (status) {
+                ath10k_err(ar, "failed to refill htt rx ring: %d\n", status);
+                goto err_hif_stop;
+        }
+
         /* we don't care about HTT in UTF mode */
         if (mode == ATH10K_FIRMWARE_MODE_NORMAL) {
                 status = ath10k_htt_setup(&ar->htt);
@@ -945,10 +1129,7 @@ int ath10k_core_start(struct ath10k *ar, enum ath10k_firmware_mode mode)
         if (status)
                 goto err_hif_stop;
 
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features))
-                ar->free_vdev_map = (1LL << TARGET_10X_NUM_VDEVS) - 1;
-        else
-                ar->free_vdev_map = (1LL << TARGET_NUM_VDEVS) - 1;
+        ar->free_vdev_map = (1LL << ar->max_num_vdevs) - 1;
 
         INIT_LIST_HEAD(&ar->arvifs);
 
@@ -1025,8 +1206,7 @@ static int ath10k_core_probe_fw(struct ath10k *ar)
         ret = ath10k_bmi_get_target_info(ar, &target_info);
         if (ret) {
                 ath10k_err(ar, "could not get target info (%d)\n", ret);
-                ath10k_hif_power_down(ar);
-                return ret;
+                goto err_power_down;
         }
 
         ar->target_version = target_info.version;
@@ -1035,28 +1215,28 @@ static int ath10k_core_probe_fw(struct ath10k *ar)
         ret = ath10k_init_hw_params(ar);
         if (ret) {
                 ath10k_err(ar, "could not get hw params (%d)\n", ret);
-                ath10k_hif_power_down(ar);
-                return ret;
+                goto err_power_down;
         }
 
         ret = ath10k_core_fetch_firmware_files(ar);
         if (ret) {
                 ath10k_err(ar, "could not fetch firmware files (%d)\n", ret);
-                ath10k_hif_power_down(ar);
-                return ret;
+                goto err_power_down;
         }
 
-        ath10k_core_init_max_sta_count(ar);
+        ret = ath10k_core_init_firmware_features(ar);
+        if (ret) {
+                ath10k_err(ar, "fatal problem with firmware features: %d\n",
+                           ret);
+                goto err_free_firmware_files;
+        }
 
         mutex_lock(&ar->conf_mutex);
 
         ret = ath10k_core_start(ar, ATH10K_FIRMWARE_MODE_NORMAL);
         if (ret) {
                 ath10k_err(ar, "could not init core (%d)\n", ret);
-                ath10k_core_free_firmware_files(ar);
-                ath10k_hif_power_down(ar);
-                mutex_unlock(&ar->conf_mutex);
-                return ret;
+                goto err_unlock;
         }
 
         ath10k_print_driver_info(ar);
@@ -1066,34 +1246,17 @@ static int ath10k_core_probe_fw(struct ath10k *ar)
 
         ath10k_hif_power_down(ar);
         return 0;
-}
-
-static int ath10k_core_check_chip_id(struct ath10k *ar)
-{
-        u32 hw_revision = MS(ar->chip_id, SOC_CHIP_ID_REV);
-
-        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot chip_id 0x%08x hw_revision 0x%x\n",
-                   ar->chip_id, hw_revision);
 
-        /* Check that we are not using hw1.0 (some of them have same pci id
-         * as hw2.0) before doing anything else as ath10k crashes horribly
-         * due to missing hw1.0 workarounds. */
-        switch (hw_revision) {
-        case QCA988X_HW_1_0_CHIP_ID_REV:
-                ath10k_err(ar, "ERROR: qca988x hw1.0 is not supported\n");
-                return -EOPNOTSUPP;
+err_unlock:
+        mutex_unlock(&ar->conf_mutex);
 
-        case QCA988X_HW_2_0_CHIP_ID_REV:
-                /* known hardware revision, continue normally */
-                return 0;
+err_free_firmware_files:
+        ath10k_core_free_firmware_files(ar);
 
-        default:
-                ath10k_warn(ar, "Warning: hardware revision unknown (0x%x), expect problems\n",
-                            ar->chip_id);
-                return 0;
-        }
+err_power_down:
+        ath10k_hif_power_down(ar);
 
-        return 0;
+        return ret;
 }
 
 static void ath10k_core_register_work(struct work_struct *work)
@@ -1125,9 +1288,18 @@ static void ath10k_core_register_work(struct work_struct *work)
                 goto err_debug_destroy;
         }
 
+        status = ath10k_thermal_register(ar);
+        if (status) {
+                ath10k_err(ar, "could not register thermal device: %d\n",
+                           status);
+                goto err_spectral_destroy;
+        }
+
         set_bit(ATH10K_FLAG_CORE_REGISTERED, &ar->dev_flags);
         return;
 
+err_spectral_destroy:
+        ath10k_spectral_destroy(ar);
 err_debug_destroy:
         ath10k_debug_destroy(ar);
 err_unregister_mac:
@@ -1143,16 +1315,7 @@ err:
 
 int ath10k_core_register(struct ath10k *ar, u32 chip_id)
 {
-        int status;
-
         ar->chip_id = chip_id;
-
-        status = ath10k_core_check_chip_id(ar);
-        if (status) {
-                ath10k_err(ar, "Unsupported chip id 0x%08x\n", ar->chip_id);
-                return status;
-        }
-
         queue_work(ar->workqueue, &ar->register_work);
 
         return 0;
@@ -1166,6 +1329,7 @@ void ath10k_core_unregister(struct ath10k *ar)
         if (!test_bit(ATH10K_FLAG_CORE_REGISTERED, &ar->dev_flags))
                 return;
 
+        ath10k_thermal_unregister(ar);
         /* Stop spectral before unregistering from mac80211 to remove the
          * relayfs debugfs file cleanly. Otherwise the parent debugfs tree
          * would be already be free'd recursively, leading to a double free.
@@ -1187,6 +1351,7 @@ EXPORT_SYMBOL(ath10k_core_unregister);
 
 struct ath10k *ath10k_core_create(size_t priv_size, struct device *dev,
                                   enum ath10k_bus bus,
+                                  enum ath10k_hw_rev hw_rev,
                                   const struct ath10k_hif_ops *hif_ops)
 {
         struct ath10k *ar;
@@ -1198,13 +1363,25 @@ struct ath10k *ath10k_core_create(size_t priv_size, struct device *dev,
 
         ar->ath_common.priv = ar;
         ar->ath_common.hw = ar->hw;
-
-        ar->p2p = !!ath10k_p2p;
         ar->dev = dev;
-
+        ar->hw_rev = hw_rev;
         ar->hif.ops = hif_ops;
         ar->hif.bus = bus;
 
+        switch (hw_rev) {
+        case ATH10K_HW_QCA988X:
+                ar->regs = &qca988x_regs;
+                break;
+        case ATH10K_HW_QCA6174:
+                ar->regs = &qca6174_regs;
+                break;
+        default:
+                ath10k_err(ar, "unsupported core hardware revision %d\n",
+                           hw_rev);
+                ret = -ENOTSUPP;
+                goto err_free_mac;
+        }
+
         init_completion(&ar->scan.started);
         init_completion(&ar->scan.completed);
         init_completion(&ar->scan.on_channel);
@@ -1212,6 +1389,7 @@ struct ath10k *ath10k_core_create(size_t priv_size, struct device *dev,
 
         init_completion(&ar->install_key_done);
         init_completion(&ar->vdev_setup_done);
+        init_completion(&ar->thermal.wmi_sync);
 
         INIT_DELAYED_WORK(&ar->scan.timeout, ath10k_scan_timeout_work);
 
diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h
index 514c219263a5..d60e46fe6d19 100644
--- a/drivers/net/wireless/ath/ath10k/core.h
+++ b/drivers/net/wireless/ath/ath10k/core.h
@@ -34,6 +34,7 @@
 #include "../regd.h"
 #include "../dfs_pattern_detector.h"
 #include "spectral.h"
+#include "thermal.h"
 
 #define MS(_v, _f) (((_v) & _f##_MASK) >> _f##_LSB)
 #define SM(_v, _f) (((_v) << _f##_LSB) & _f##_MASK)
@@ -96,6 +97,11 @@ struct ath10k_skb_cb {
         } bcn;
 } __packed;
 
+struct ath10k_skb_rxcb {
+        dma_addr_t paddr;
+        struct hlist_node hlist;
+};
+
 static inline struct ath10k_skb_cb *ATH10K_SKB_CB(struct sk_buff *skb)
 {
         BUILD_BUG_ON(sizeof(struct ath10k_skb_cb) >
@@ -103,6 +109,15 @@ static inline struct ath10k_skb_cb *ATH10K_SKB_CB(struct sk_buff *skb)
         return (struct ath10k_skb_cb *)&IEEE80211_SKB_CB(skb)->driver_data;
 }
 
+static inline struct ath10k_skb_rxcb *ATH10K_SKB_RXCB(struct sk_buff *skb)
+{
+        BUILD_BUG_ON(sizeof(struct ath10k_skb_rxcb) > sizeof(skb->cb));
+        return (struct ath10k_skb_rxcb *)skb->cb;
+}
+
+#define ATH10K_RXCB_SKB(rxcb) \
+                container_of((void *)rxcb, struct sk_buff, cb)
+
 static inline u32 host_interest_item_address(u32 item_offset)
 {
         return QCA988X_HOST_INTEREST_ADDRESS + item_offset;
@@ -120,6 +135,7 @@ struct ath10k_mem_chunk {
 };
 
 struct ath10k_wmi {
+        enum ath10k_fw_wmi_op_version op_version;
         enum ath10k_htc_ep_id eid;
         struct completion service_ready;
         struct completion unified_ready;
@@ -128,6 +144,7 @@ struct ath10k_wmi {
         struct wmi_cmd_map *cmd;
         struct wmi_vdev_param_map *vdev_param;
         struct wmi_pdev_param_map *pdev_param;
+        const struct wmi_ops *ops;
 
         u32 num_mem_chunks;
         struct ath10k_mem_chunk mem_chunks[WMI_MAX_MEM_REQS];
@@ -236,10 +253,21 @@ struct ath10k_sta {
         u32 smps;
 
         struct work_struct update_wk;
+
+#ifdef CONFIG_MAC80211_DEBUGFS
+        /* protected by conf_mutex */
+        bool aggr_mode;
+#endif
 };
 
 #define ATH10K_VDEV_SETUP_TIMEOUT_HZ (5*HZ)
 
+enum ath10k_beacon_state {
+        ATH10K_BEACON_SCHEDULED = 0,
+        ATH10K_BEACON_SENDING,
+        ATH10K_BEACON_SENT,
+};
+
 struct ath10k_vif {
         struct list_head list;
 
@@ -250,7 +278,7 @@ struct ath10k_vif {
         u32 dtim_period;
         struct sk_buff *beacon;
         /* protected by data_lock */
-        bool beacon_sent;
+        enum ath10k_beacon_state beacon_state;
         void *beacon_buf;
         dma_addr_t beacon_paddr;
 
@@ -263,10 +291,8 @@ struct ath10k_vif {
         u32 aid;
         u8 bssid[ETH_ALEN];
 
-        struct work_struct wep_key_work;
         struct ieee80211_key_conf *wep_keys[WMI_MAX_KEY_INDEX + 1];
-        u8 def_wep_key_idx;
-        u8 def_wep_key_newidx;
+        s8 def_wep_key_idx;
 
         u16 tx_seq_no;
 
@@ -293,6 +319,7 @@ struct ath10k_vif {
         bool use_cts_prot;
         int num_legacy_stations;
         int txpower;
+        struct wmi_wmm_params_all_arg wmm_params;
 };
 
 struct ath10k_vif_iter {
@@ -323,8 +350,10 @@ struct ath10k_debug {
 
         /* protected by conf_mutex */
         u32 fw_dbglog_mask;
+        u32 fw_dbglog_level;
         u32 pktlog_filter;
         u32 reg_addr;
+        u32 nf_cal_period;
 
         u8 htt_max_amsdu;
         u8 htt_max_ampdu;
@@ -369,7 +398,7 @@ enum ath10k_fw_features {
         /* wmi_mgmt_rx_hdr contains extra RSSI information */
         ATH10K_FW_FEATURE_EXT_WMI_MGMT_RX = 0,
 
-        /* firmware from 10X branch */
+        /* Firmware from 10X branch. Deprecated, don't use in new code. */
         ATH10K_FW_FEATURE_WMI_10X = 1,
 
         /* firmware support tx frame management over WMI, otherwise it's HTT */
@@ -378,8 +407,9 @@ enum ath10k_fw_features {
         /* Firmware does not support P2P */
         ATH10K_FW_FEATURE_NO_P2P = 3,
 
-        /* Firmware 10.2 feature bit. The ATH10K_FW_FEATURE_WMI_10X feature bit
-         * is required to be set as well.
+        /* Firmware 10.2 feature bit. The ATH10K_FW_FEATURE_WMI_10X feature
+         * bit is required to be set as well. Deprecated, don't use in new
+         * code.
          */
         ATH10K_FW_FEATURE_WMI_10_2 = 4,
 
@@ -401,6 +431,7 @@ enum ath10k_dev_flags {
 enum ath10k_cal_mode {
         ATH10K_CAL_MODE_FILE,
         ATH10K_CAL_MODE_OTP,
+        ATH10K_CAL_MODE_DT,
 };
 
 static inline const char *ath10k_cal_mode_str(enum ath10k_cal_mode mode)
@@ -410,6 +441,8 @@ static inline const char *ath10k_cal_mode_str(enum ath10k_cal_mode mode)
                 return "file";
         case ATH10K_CAL_MODE_OTP:
                 return "otp";
+        case ATH10K_CAL_MODE_DT:
+                return "dt";
         }
 
         return "unknown";
@@ -444,6 +477,7 @@ struct ath10k {
         struct device *dev;
         u8 mac_addr[ETH_ALEN];
 
+        enum ath10k_hw_rev hw_rev;
         u32 chip_id;
         u32 target_version;
         u8 fw_version_major;
@@ -459,9 +493,6 @@ struct ath10k {
 
         DECLARE_BITMAP(fw_features, ATH10K_FW_FEATURE_COUNT);
 
-        struct targetdef *targetdef;
-        struct hostdef *hostdef;
-
         bool p2p;
 
         struct {
@@ -471,6 +502,7 @@ struct ath10k {
 
         struct completion target_suspend;
 
+        const struct ath10k_hw_regs *regs;
         struct ath10k_bmi bmi;
         struct ath10k_wmi wmi;
         struct ath10k_htc htc;
@@ -480,12 +512,15 @@ struct ath10k {
                 u32 id;
                 const char *name;
                 u32 patch_load_addr;
+                int uart_pin;
 
                 struct ath10k_hw_params_fw {
                         const char *dir;
                         const char *fw;
                         const char *otp;
                         const char *board;
+                        size_t board_size;
+                        size_t board_ext_size;
                 } fw;
         } hw_params;
 
@@ -548,7 +583,6 @@ struct ath10k {
         u8 cfg_tx_chainmask;
         u8 cfg_rx_chainmask;
 
-        struct wmi_pdev_set_wmm_params_arg wmm_params;
         struct completion install_key_done;
 
         struct completion vdev_setup_done;
@@ -571,6 +605,7 @@ struct ath10k {
 
         int max_num_peers;
         int max_num_stations;
+        int max_num_vdevs;
 
         struct work_struct offchan_tx_work;
         struct sk_buff_head offchan_tx_queue;
@@ -610,6 +645,7 @@ struct ath10k {
                 /* protected by conf_mutex */
                 const struct firmware *utf;
                 DECLARE_BITMAP(orig_fw_features, ATH10K_FW_FEATURE_COUNT);
+                enum ath10k_fw_wmi_op_version orig_wmi_op_version;
 
                 /* protected by data_lock */
                 bool utf_monitor;
@@ -622,12 +658,15 @@ struct ath10k {
                 u32 fw_cold_reset_counter;
         } stats;
 
+        struct ath10k_thermal thermal;
+
         /* must be last */
         u8 drv_priv[0] __aligned(sizeof(void *));
 };
 
 struct ath10k *ath10k_core_create(size_t priv_size, struct device *dev,
                                   enum ath10k_bus bus,
+                                  enum ath10k_hw_rev hw_rev,
                                   const struct ath10k_hif_ops *hif_ops);
 void ath10k_core_destroy(struct ath10k *ar);
 
diff --git a/drivers/net/wireless/ath/ath10k/debug.c b/drivers/net/wireless/ath/ath10k/debug.c
index a716758f14b0..d2281e5c2ffe 100644
--- a/drivers/net/wireless/ath/ath10k/debug.c
+++ b/drivers/net/wireless/ath/ath10k/debug.c
@@ -23,6 +23,7 @@
 #include "core.h"
 #include "debug.h"
 #include "hif.h"
+#include "wmi-ops.h"
 
 /* ms */
 #define ATH10K_DEBUG_HTT_STATS_INTERVAL 1000
@@ -123,7 +124,7 @@ EXPORT_SYMBOL(ath10k_info);
 
 void ath10k_print_driver_info(struct ath10k *ar)
 {
-        ath10k_info(ar, "%s (0x%08x, 0x%08x) fw %s api %d htt %d.%d wmi %d.%d.%d.%d cal %s max_sta %d\n",
+        ath10k_info(ar, "%s (0x%08x, 0x%08x) fw %s api %d htt %d.%d wmi %d cal %s max_sta %d\n",
                     ar->hw_params.name,
                     ar->target_version,
                     ar->chip_id,
@@ -131,10 +132,7 @@ void ath10k_print_driver_info(struct ath10k *ar)
                     ar->fw_api,
                     ar->htt.target_version_major,
                     ar->htt.target_version_minor,
-                    ar->fw_version_major,
-                    ar->fw_version_minor,
-                    ar->fw_version_release,
-                    ar->fw_version_build,
+                    ar->wmi.op_version,
                     ath10k_cal_mode_str(ar->cal_mode),
                     ar->max_num_stations);
         ath10k_info(ar, "debug %d debugfs %d tracing %d dfs %d testmode %d\n",
@@ -373,7 +371,7 @@ static int ath10k_debug_fw_stats_request(struct ath10k *ar)
 
                 ret = wait_for_completion_timeout(&ar->debug.fw_stats_complete,
                                                   1*HZ);
-                if (ret <= 0)
+                if (ret == 0)
                         return -ETIMEDOUT;
 
                 spin_lock_bh(&ar->data_lock);
@@ -1320,10 +1318,10 @@ static ssize_t ath10k_read_fw_dbglog(struct file *file,
 {
         struct ath10k *ar = file->private_data;
         unsigned int len;
-        char buf[32];
+        char buf[64];
 
-        len = scnprintf(buf, sizeof(buf), "0x%08x\n",
-                        ar->debug.fw_dbglog_mask);
+        len = scnprintf(buf, sizeof(buf), "0x%08x %u\n",
+                        ar->debug.fw_dbglog_mask, ar->debug.fw_dbglog_level);
 
         return simple_read_from_buffer(user_buf, count, ppos, buf, len);
 }
@@ -1333,19 +1331,32 @@ static ssize_t ath10k_write_fw_dbglog(struct file *file,
                                       size_t count, loff_t *ppos)
 {
         struct ath10k *ar = file->private_data;
-        unsigned long mask;
         int ret;
+        char buf[64];
+        unsigned int log_level, mask;
 
-        ret = kstrtoul_from_user(user_buf, count, 0, &mask);
-        if (ret)
-                return ret;
+        simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf, count);
+
+        /* make sure that buf is null terminated */
+        buf[sizeof(buf) - 1] = 0;
+
+        ret = sscanf(buf, "%x %u", &mask, &log_level);
+
+        if (!ret)
+                return -EINVAL;
+
+        if (ret == 1)
+                /* default if user did not specify */
+                log_level = ATH10K_DBGLOG_LEVEL_WARN;
 
         mutex_lock(&ar->conf_mutex);
 
         ar->debug.fw_dbglog_mask = mask;
+        ar->debug.fw_dbglog_level = log_level;
 
         if (ar->state == ATH10K_STATE_ON) {
-                ret = ath10k_wmi_dbglog_cfg(ar, ar->debug.fw_dbglog_mask);
+                ret = ath10k_wmi_dbglog_cfg(ar, ar->debug.fw_dbglog_mask,
+                                            ar->debug.fw_dbglog_level);
                 if (ret) {
                         ath10k_warn(ar, "dbglog cfg failed from debugfs: %d\n",
                                     ret);
@@ -1607,6 +1618,73 @@ static const struct file_operations fops_cal_data = {
         .llseek = default_llseek,
 };
 
+static ssize_t ath10k_read_nf_cal_period(struct file *file,
+                                         char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct ath10k *ar = file->private_data;
+        unsigned int len;
+        char buf[32];
+
+        len = scnprintf(buf, sizeof(buf), "%d\n",
+                        ar->debug.nf_cal_period);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t ath10k_write_nf_cal_period(struct file *file,
+                                          const char __user *user_buf,
+                                          size_t count, loff_t *ppos)
+{
+        struct ath10k *ar = file->private_data;
+        unsigned long period;
+        int ret;
+
+        ret = kstrtoul_from_user(user_buf, count, 0, &period);
+        if (ret)
+                return ret;
+
+        if (period > WMI_PDEV_PARAM_CAL_PERIOD_MAX)
+                return -EINVAL;
+
+        /* there's no way to switch back to the firmware default */
+        if (period == 0)
+                return -EINVAL;
+
+        mutex_lock(&ar->conf_mutex);
+
+        ar->debug.nf_cal_period = period;
+
+        if (ar->state != ATH10K_STATE_ON) {
+                /* firmware is not running, nothing else to do */
+                ret = count;
+                goto exit;
+        }
+
+        ret = ath10k_wmi_pdev_set_param(ar, ar->wmi.pdev_param->cal_period,
+                                        ar->debug.nf_cal_period);
+        if (ret) {
+                ath10k_warn(ar, "cal period cfg failed from debugfs: %d\n",
+                            ret);
+                goto exit;
+        }
+
+        ret = count;
+
+exit:
+        mutex_unlock(&ar->conf_mutex);
+
+        return ret;
+}
+
+static const struct file_operations fops_nf_cal_period = {
+        .read = ath10k_read_nf_cal_period,
+        .write = ath10k_write_nf_cal_period,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
 int ath10k_debug_start(struct ath10k *ar)
 {
         int ret;
@@ -1620,7 +1698,8 @@ int ath10k_debug_start(struct ath10k *ar)
                             ret);
 
         if (ar->debug.fw_dbglog_mask) {
-                ret = ath10k_wmi_dbglog_cfg(ar, ar->debug.fw_dbglog_mask);
+                ret = ath10k_wmi_dbglog_cfg(ar, ar->debug.fw_dbglog_mask,
+                                            ATH10K_DBGLOG_LEVEL_WARN);
                 if (ret)
                         /* not serious */
                         ath10k_warn(ar, "failed to enable dbglog during start: %d",
@@ -1642,6 +1721,16 @@ int ath10k_debug_start(struct ath10k *ar)
                         ath10k_warn(ar, "failed to disable pktlog: %d\n", ret);
         }
 
+        if (ar->debug.nf_cal_period) {
+                ret = ath10k_wmi_pdev_set_param(ar,
+                                                ar->wmi.pdev_param->cal_period,
+                                                ar->debug.nf_cal_period);
+                if (ret)
+                        /* not serious */
+                        ath10k_warn(ar, "cal period cfg failed from debug start: %d\n",
+                                    ret);
+        }
+
         return ret;
 }
 
@@ -1880,6 +1969,9 @@ int ath10k_debug_register(struct ath10k *ar)
         debugfs_create_file("cal_data", S_IRUSR, ar->debug.debugfs_phy,
                             ar, &fops_cal_data);
 
+        debugfs_create_file("nf_cal_period", S_IRUSR | S_IWUSR,
+                            ar->debug.debugfs_phy, ar, &fops_nf_cal_period);
+
         if (config_enabled(CONFIG_ATH10K_DFS_CERTIFIED)) {
                 debugfs_create_file("dfs_simulate_radar", S_IWUSR,
                                     ar->debug.debugfs_phy, ar,
diff --git a/drivers/net/wireless/ath/ath10k/debug.h b/drivers/net/wireless/ath/ath10k/debug.h
index 1b87a5dbec53..a12b8323f9f1 100644
--- a/drivers/net/wireless/ath/ath10k/debug.h
+++ b/drivers/net/wireless/ath/ath10k/debug.h
@@ -48,6 +48,12 @@ enum ath10k_pktlog_filter {
         ATH10K_PKTLOG_ANY        = 0x00000001f,
 };
 
+enum ath10k_dbg_aggr_mode {
+        ATH10K_DBG_AGGR_MODE_AUTO,
+        ATH10K_DBG_AGGR_MODE_MANUAL,
+        ATH10K_DBG_AGGR_MODE_MAX,
+};
+
 extern unsigned int ath10k_debug_mask;
 
 __printf(2, 3) void ath10k_info(struct ath10k *ar, const char *fmt, ...);
@@ -77,7 +83,6 @@ int ath10k_debug_get_et_sset_count(struct ieee80211_hw *hw,
 void ath10k_debug_get_et_stats(struct ieee80211_hw *hw,
                                struct ieee80211_vif *vif,
                                struct ethtool_stats *stats, u64 *data);
-
 #else
 static inline int ath10k_debug_start(struct ath10k *ar)
 {
@@ -129,6 +134,10 @@ ath10k_debug_get_new_fw_crash_data(struct ath10k *ar)
 #define ath10k_debug_get_et_stats NULL
 
 #endif /* CONFIG_ATH10K_DEBUGFS */
+#ifdef CONFIG_MAC80211_DEBUGFS
+void ath10k_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                            struct ieee80211_sta *sta, struct dentry *dir);
+#endif /* CONFIG_MAC80211_DEBUGFS */
 
 #ifdef CONFIG_ATH10K_DEBUG
 __printf(3, 4) void ath10k_dbg(struct ath10k *ar,
diff --git a/drivers/net/wireless/ath/ath10k/debugfs_sta.c b/drivers/net/wireless/ath/ath10k/debugfs_sta.c
new file mode 100644
index 000000000000..95b5c49374e0
--- /dev/null
+++ b/drivers/net/wireless/ath/ath10k/debugfs_sta.c
@@ -0,0 +1,243 @@
+/*
+ * Copyright (c) 2014 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "core.h"
+#include "wmi-ops.h"
+#include "debug.h"
+
+static ssize_t ath10k_dbg_sta_read_aggr_mode(struct file *file,
+                                             char __user *user_buf,
+                                             size_t count, loff_t *ppos)
+{
+        struct ieee80211_sta *sta = file->private_data;
+        struct ath10k_sta *arsta = (struct ath10k_sta *)sta->drv_priv;
+        struct ath10k *ar = arsta->arvif->ar;
+        char buf[32];
+        int len = 0;
+
+        mutex_lock(&ar->conf_mutex);
+        len = scnprintf(buf, sizeof(buf) - len, "aggregation mode: %s\n",
+                        (arsta->aggr_mode == ATH10K_DBG_AGGR_MODE_AUTO) ?
+                        "auto" : "manual");
+        mutex_unlock(&ar->conf_mutex);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t ath10k_dbg_sta_write_aggr_mode(struct file *file,
+                                              const char __user *user_buf,
+                                              size_t count, loff_t *ppos)
+{
+        struct ieee80211_sta *sta = file->private_data;
+        struct ath10k_sta *arsta = (struct ath10k_sta *)sta->drv_priv;
+        struct ath10k *ar = arsta->arvif->ar;
+        u32 aggr_mode;
+        int ret;
+
+        if (kstrtouint_from_user(user_buf, count, 0, &aggr_mode))
+                return -EINVAL;
+
+        if (aggr_mode >= ATH10K_DBG_AGGR_MODE_MAX)
+                return -EINVAL;
+
+        mutex_lock(&ar->conf_mutex);
+        if ((ar->state != ATH10K_STATE_ON) ||
+            (aggr_mode == arsta->aggr_mode)) {
+                ret = count;
+                goto out;
+        }
+
+        ret = ath10k_wmi_addba_clear_resp(ar, arsta->arvif->vdev_id, sta->addr);
+        if (ret) {
+                ath10k_warn(ar, "failed to clear addba session ret: %d\n", ret);
+                goto out;
+        }
+
+        arsta->aggr_mode = aggr_mode;
+out:
+        mutex_unlock(&ar->conf_mutex);
+        return ret;
+}
+
+static const struct file_operations fops_aggr_mode = {
+        .read = ath10k_dbg_sta_read_aggr_mode,
+        .write = ath10k_dbg_sta_write_aggr_mode,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+static ssize_t ath10k_dbg_sta_write_addba(struct file *file,
+                                          const char __user *user_buf,
+                                          size_t count, loff_t *ppos)
+{
+        struct ieee80211_sta *sta = file->private_data;
+        struct ath10k_sta *arsta = (struct ath10k_sta *)sta->drv_priv;
+        struct ath10k *ar = arsta->arvif->ar;
+        u32 tid, buf_size;
+        int ret;
+        char buf[64];
+
+        simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf, count);
+
+        /* make sure that buf is null terminated */
+        buf[sizeof(buf) - 1] = '\0';
+
+        ret = sscanf(buf, "%u %u", &tid, &buf_size);
+        if (ret != 2)
+                return -EINVAL;
+
+        /* Valid TID values are 0 through 15 */
+        if (tid > HTT_DATA_TX_EXT_TID_MGMT - 2)
+                return -EINVAL;
+
+        mutex_lock(&ar->conf_mutex);
+        if ((ar->state != ATH10K_STATE_ON) ||
+            (arsta->aggr_mode != ATH10K_DBG_AGGR_MODE_MANUAL)) {
+                ret = count;
+                goto out;
+        }
+
+        ret = ath10k_wmi_addba_send(ar, arsta->arvif->vdev_id, sta->addr,
+                                    tid, buf_size);
+        if (ret) {
+                ath10k_warn(ar, "failed to send addba request: vdev_id %u peer %pM tid %u buf_size %u\n",
+                            arsta->arvif->vdev_id, sta->addr, tid, buf_size);
+        }
+
+        ret = count;
+out:
+        mutex_unlock(&ar->conf_mutex);
+        return ret;
+}
+
+static const struct file_operations fops_addba = {
+        .write = ath10k_dbg_sta_write_addba,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+static ssize_t ath10k_dbg_sta_write_addba_resp(struct file *file,
+                                               const char __user *user_buf,
+                                               size_t count, loff_t *ppos)
+{
+        struct ieee80211_sta *sta = file->private_data;
+        struct ath10k_sta *arsta = (struct ath10k_sta *)sta->drv_priv;
+        struct ath10k *ar = arsta->arvif->ar;
+        u32 tid, status;
+        int ret;
+        char buf[64];
+
+        simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf, count);
+
+        /* make sure that buf is null terminated */
+        buf[sizeof(buf) - 1] = '\0';
+
+        ret = sscanf(buf, "%u %u", &tid, &status);
+        if (ret != 2)
+                return -EINVAL;
+
+        /* Valid TID values are 0 through 15 */
+        if (tid > HTT_DATA_TX_EXT_TID_MGMT - 2)
+                return -EINVAL;
+
+        mutex_lock(&ar->conf_mutex);
+        if ((ar->state != ATH10K_STATE_ON) ||
+            (arsta->aggr_mode != ATH10K_DBG_AGGR_MODE_MANUAL)) {
+                ret = count;
+                goto out;
+        }
+
+        ret = ath10k_wmi_addba_set_resp(ar, arsta->arvif->vdev_id, sta->addr,
+                                        tid, status);
+        if (ret) {
+                ath10k_warn(ar, "failed to send addba response: vdev_id %u peer %pM tid %u status%u\n",
+                            arsta->arvif->vdev_id, sta->addr, tid, status);
+        }
+        ret = count;
+out:
+        mutex_unlock(&ar->conf_mutex);
+        return ret;
+}
+
+static const struct file_operations fops_addba_resp = {
+        .write = ath10k_dbg_sta_write_addba_resp,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+static ssize_t ath10k_dbg_sta_write_delba(struct file *file,
+                                          const char __user *user_buf,
+                                          size_t count, loff_t *ppos)
+{
+        struct ieee80211_sta *sta = file->private_data;
+        struct ath10k_sta *arsta = (struct ath10k_sta *)sta->drv_priv;
+        struct ath10k *ar = arsta->arvif->ar;
+        u32 tid, initiator, reason;
+        int ret;
+        char buf[64];
+
+        simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf, count);
+
+        /* make sure that buf is null terminated */
+        buf[sizeof(buf) - 1] = '\0';
+
+        ret = sscanf(buf, "%u %u %u", &tid, &initiator, &reason);
+        if (ret != 3)
+                return -EINVAL;
+
+        /* Valid TID values are 0 through 15 */
+        if (tid > HTT_DATA_TX_EXT_TID_MGMT - 2)
+                return -EINVAL;
+
+        mutex_lock(&ar->conf_mutex);
+        if ((ar->state != ATH10K_STATE_ON) ||
+            (arsta->aggr_mode != ATH10K_DBG_AGGR_MODE_MANUAL)) {
+                ret = count;
+                goto out;
+        }
+
+        ret = ath10k_wmi_delba_send(ar, arsta->arvif->vdev_id, sta->addr,
+                                    tid, initiator, reason);
+        if (ret) {
+                ath10k_warn(ar, "failed to send delba: vdev_id %u peer %pM tid %u initiator %u reason %u\n",
+                            arsta->arvif->vdev_id, sta->addr, tid, initiator,
+                            reason);
+        }
+        ret = count;
+out:
+        mutex_unlock(&ar->conf_mutex);
+        return ret;
+}
+
+static const struct file_operations fops_delba = {
+        .write = ath10k_dbg_sta_write_delba,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+void ath10k_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                            struct ieee80211_sta *sta, struct dentry *dir)
+{
+        debugfs_create_file("aggr_mode", S_IRUGO | S_IWUSR, dir, sta,
+                            &fops_aggr_mode);
+        debugfs_create_file("addba", S_IWUSR, dir, sta, &fops_addba);
+        debugfs_create_file("addba_resp", S_IWUSR, dir, sta, &fops_addba_resp);
+        debugfs_create_file("delba", S_IWUSR, dir, sta, &fops_delba);
+}
diff --git a/drivers/net/wireless/ath/ath10k/htc.c b/drivers/net/wireless/ath/ath10k/htc.c
index f1946a6be442..2fd9e180272b 100644
--- a/drivers/net/wireless/ath/ath10k/htc.c
+++ b/drivers/net/wireless/ath/ath10k/htc.c
@@ -703,11 +703,9 @@ int ath10k_htc_connect_service(struct ath10k_htc *htc,
         /* wait for response */
         status = wait_for_completion_timeout(&htc->ctl_resp,
                                              ATH10K_HTC_CONN_SVC_TIMEOUT_HZ);
-        if (status <= 0) {
-                if (status == 0)
-                        status = -ETIMEDOUT;
+        if (status == 0) {
                 ath10k_err(ar, "Service connect timeout: %d\n", status);
-                return status;
+                return -ETIMEDOUT;
         }
 
         /* we controlled the buffer creation, it's aligned */
diff --git a/drivers/net/wireless/ath/ath10k/htt.c b/drivers/net/wireless/ath/ath10k/htt.c
index 56cb4aceb383..4f59ab923e48 100644
--- a/drivers/net/wireless/ath/ath10k/htt.c
+++ b/drivers/net/wireless/ath/ath10k/htt.c
@@ -53,7 +53,6 @@ int ath10k_htt_init(struct ath10k *ar)
         struct ath10k_htt *htt = &ar->htt;
 
         htt->ar = ar;
-        htt->max_throughput_mbps = 800;
 
         /*
          * Prefetch enough data to satisfy target
@@ -102,7 +101,7 @@ int ath10k_htt_setup(struct ath10k_htt *htt)
 
         status = wait_for_completion_timeout(&htt->target_version_received,
                                              HTT_TARGET_VERSION_TIMEOUT_HZ);
-        if (status <= 0) {
+        if (status == 0) {
                 ath10k_warn(ar, "htt version request timed out\n");
                 return -ETIMEDOUT;
         }
diff --git a/drivers/net/wireless/ath/ath10k/htt.h b/drivers/net/wireless/ath/ath10k/htt.h
index 1bd5545af903..874bf44ff7a2 100644
--- a/drivers/net/wireless/ath/ath10k/htt.h
+++ b/drivers/net/wireless/ath/ath10k/htt.h
@@ -21,6 +21,7 @@
 #include <linux/bug.h>
 #include <linux/interrupt.h>
 #include <linux/dmapool.h>
+#include <linux/hashtable.h>
 #include <net/mac80211.h>
 
 #include "htc.h"
@@ -286,7 +287,19 @@ enum htt_t2h_msg_type {
         HTT_T2H_MSG_TYPE_RC_UPDATE_IND          = 0xc,
         HTT_T2H_MSG_TYPE_TX_INSPECT_IND         = 0xd,
         HTT_T2H_MSG_TYPE_MGMT_TX_COMPLETION     = 0xe,
+        HTT_T2H_MSG_TYPE_TX_CREDIT_UPDATE_IND   = 0xf,
+        HTT_T2H_MSG_TYPE_RX_PN_IND              = 0x10,
+        HTT_T2H_MSG_TYPE_RX_OFFLOAD_DELIVER_IND = 0x11,
+        HTT_T2H_MSG_TYPE_RX_IN_ORD_PADDR_IND    = 0x12,
+        /* 0x13 reservd */
+        HTT_T2H_MSG_TYPE_WDI_IPA_OP_RESPONSE    = 0x14,
+
+        /* FIXME: Do not depend on this event id. Numbering of this event id is
+         * broken across different firmware revisions and HTT version fails to
+         * indicate this.
+         */
         HTT_T2H_MSG_TYPE_TEST,
+
         /* keep this last */
         HTT_T2H_NUM_MSGS
 };
@@ -655,6 +668,53 @@ struct htt_rx_fragment_indication {
 #define HTT_RX_FRAG_IND_INFO1_FLUSH_SEQ_NUM_END_MASK   0x00000FC0
 #define HTT_RX_FRAG_IND_INFO1_FLUSH_SEQ_NUM_END_LSB    6
 
+struct htt_rx_pn_ind {
+        __le16 peer_id;
+        u8 tid;
+        u8 seqno_start;
+        u8 seqno_end;
+        u8 pn_ie_count;
+        u8 reserved;
+        u8 pn_ies[0];
+} __packed;
+
+struct htt_rx_offload_msdu {
+        __le16 msdu_len;
+        __le16 peer_id;
+        u8 vdev_id;
+        u8 tid;
+        u8 fw_desc;
+        u8 payload[0];
+} __packed;
+
+struct htt_rx_offload_ind {
+        u8 reserved;
+        __le16 msdu_count;
+} __packed;
+
+struct htt_rx_in_ord_msdu_desc {
+        __le32 msdu_paddr;
+        __le16 msdu_len;
+        u8 fw_desc;
+        u8 reserved;
+} __packed;
+
+struct htt_rx_in_ord_ind {
+        u8 info;
+        __le16 peer_id;
+        u8 vdev_id;
+        u8 reserved;
+        __le16 msdu_count;
+        struct htt_rx_in_ord_msdu_desc msdu_descs[0];
+} __packed;
+
+#define HTT_RX_IN_ORD_IND_INFO_TID_MASK         0x0000001f
+#define HTT_RX_IN_ORD_IND_INFO_TID_LSB          0
+#define HTT_RX_IN_ORD_IND_INFO_OFFLOAD_MASK     0x00000020
+#define HTT_RX_IN_ORD_IND_INFO_OFFLOAD_LSB      5
+#define HTT_RX_IN_ORD_IND_INFO_FRAG_MASK        0x00000040
+#define HTT_RX_IN_ORD_IND_INFO_FRAG_LSB         6
+
 /*
  * target -> host test message definition
  *
@@ -1150,6 +1210,9 @@ struct htt_resp {
                 struct htt_rx_test rx_test;
                 struct htt_pktlog_msg pktlog_msg;
                 struct htt_stats_conf stats_conf;
+                struct htt_rx_pn_ind rx_pn_ind;
+                struct htt_rx_offload_ind rx_offload_ind;
+                struct htt_rx_in_ord_ind rx_in_ord_ind;
         };
 } __packed;
 
@@ -1182,7 +1245,6 @@ struct ath10k_htt {
         struct ath10k *ar;
         enum ath10k_htc_ep_id eid;
 
-        int max_throughput_mbps;
         u8 target_version_major;
         u8 target_version_minor;
         struct completion target_version_received;
@@ -1198,6 +1260,20 @@ struct ath10k_htt {
                  * filled.
                  */
                 struct sk_buff **netbufs_ring;
+
+                /* This is used only with firmware supporting IN_ORD_IND.
+                 *
+                 * With Full Rx Reorder the HTT Rx Ring is more of a temporary
+                 * buffer ring from which buffer addresses are copied by the
+                 * firmware to MAC Rx ring. Firmware then delivers IN_ORD_IND
+                 * pointing to specific (re-ordered) buffers.
+                 *
+                 * FIXME: With kernel generic hashing functions there's a lot
+                 * of hash collisions for sk_buffs.
+                 */
+                bool in_ord_rx;
+                DECLARE_HASHTABLE(skb_table, 4);
+
                 /*
                  * Ring of buffer addresses -
                  * This ring holds the "physical" device address of the
@@ -1252,12 +1328,11 @@ struct ath10k_htt {
 
         unsigned int prefetch_len;
 
-        /* Protects access to %pending_tx, %used_msdu_ids */
+        /* Protects access to pending_tx, num_pending_tx */
         spinlock_t tx_lock;
         int max_num_pending_tx;
         int num_pending_tx;
-        struct sk_buff **pending_tx;
-        unsigned long *used_msdu_ids; /* bitmap */
+        struct idr pending_tx;
         wait_queue_head_t empty_tx_wq;
         struct dma_pool *tx_pool;
 
@@ -1271,6 +1346,7 @@ struct ath10k_htt {
         struct tasklet_struct txrx_compl_task;
         struct sk_buff_head tx_compl_q;
         struct sk_buff_head rx_compl_q;
+        struct sk_buff_head rx_in_ord_compl_q;
 
         /* rx_status template */
         struct ieee80211_rx_status rx_status;
@@ -1334,6 +1410,7 @@ int ath10k_htt_tx_alloc(struct ath10k_htt *htt);
 void ath10k_htt_tx_free(struct ath10k_htt *htt);
 
 int ath10k_htt_rx_alloc(struct ath10k_htt *htt);
+int ath10k_htt_rx_ring_refill(struct ath10k *ar);
 void ath10k_htt_rx_free(struct ath10k_htt *htt);
 
 void ath10k_htt_htc_tx_complete(struct ath10k *ar, struct sk_buff *skb);
@@ -1346,7 +1423,7 @@ int ath10k_htt_h2t_aggr_cfg_msg(struct ath10k_htt *htt,
                                 u8 max_subfrms_amsdu);
 
 void __ath10k_htt_tx_dec_pending(struct ath10k_htt *htt);
-int ath10k_htt_tx_alloc_msdu_id(struct ath10k_htt *htt);
+int ath10k_htt_tx_alloc_msdu_id(struct ath10k_htt *htt, struct sk_buff *skb);
 void ath10k_htt_tx_free_msdu_id(struct ath10k_htt *htt, u16 msdu_id);
 int ath10k_htt_mgmt_tx(struct ath10k_htt *htt, struct sk_buff *);
 int ath10k_htt_tx(struct ath10k_htt *htt, struct sk_buff *);
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index 9c782a42665e..c1da44f65a4d 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -25,8 +25,8 @@
 
 #include <linux/log2.h>
 
-#define HTT_RX_RING_SIZE 1024
-#define HTT_RX_RING_FILL_LEVEL 1000
+#define HTT_RX_RING_SIZE HTT_RX_RING_SIZE_MAX
+#define HTT_RX_RING_FILL_LEVEL (((HTT_RX_RING_SIZE) / 2) - 1)
 
 /* when under memory pressure rx ring refill may fail and needs a retry */
 #define HTT_RX_RING_REFILL_RETRY_MS 50
@@ -34,31 +34,70 @@
 static int ath10k_htt_rx_get_csum_state(struct sk_buff *skb);
 static void ath10k_htt_txrx_compl_task(unsigned long ptr);
 
+static struct sk_buff *
+ath10k_htt_rx_find_skb_paddr(struct ath10k *ar, u32 paddr)
+{
+        struct ath10k_skb_rxcb *rxcb;
+
+        hash_for_each_possible(ar->htt.rx_ring.skb_table, rxcb, hlist, paddr)
+                if (rxcb->paddr == paddr)
+                        return ATH10K_RXCB_SKB(rxcb);
+
+        WARN_ON_ONCE(1);
+        return NULL;
+}
+
 static void ath10k_htt_rx_ring_free(struct ath10k_htt *htt)
 {
         struct sk_buff *skb;
-        struct ath10k_skb_cb *cb;
+        struct ath10k_skb_rxcb *rxcb;
+        struct hlist_node *n;
         int i;
 
-        for (i = 0; i < htt->rx_ring.fill_cnt; i++) {
-                skb = htt->rx_ring.netbufs_ring[i];
-                cb = ATH10K_SKB_CB(skb);
-                dma_unmap_single(htt->ar->dev, cb->paddr,
-                                 skb->len + skb_tailroom(skb),
-                                 DMA_FROM_DEVICE);
-                dev_kfree_skb_any(skb);
+        if (htt->rx_ring.in_ord_rx) {
+                hash_for_each_safe(htt->rx_ring.skb_table, i, n, rxcb, hlist) {
+                        skb = ATH10K_RXCB_SKB(rxcb);
+                        dma_unmap_single(htt->ar->dev, rxcb->paddr,
+                                         skb->len + skb_tailroom(skb),
+                                         DMA_FROM_DEVICE);
+                        hash_del(&rxcb->hlist);
+                        dev_kfree_skb_any(skb);
+                }
+        } else {
+                for (i = 0; i < htt->rx_ring.size; i++) {
+                        skb = htt->rx_ring.netbufs_ring[i];
+                        if (!skb)
+                                continue;
+
+                        rxcb = ATH10K_SKB_RXCB(skb);
+                        dma_unmap_single(htt->ar->dev, rxcb->paddr,
+                                         skb->len + skb_tailroom(skb),
+                                         DMA_FROM_DEVICE);
+                        dev_kfree_skb_any(skb);
+                }
         }
 
         htt->rx_ring.fill_cnt = 0;
+        hash_init(htt->rx_ring.skb_table);
+        memset(htt->rx_ring.netbufs_ring, 0,
+               htt->rx_ring.size * sizeof(htt->rx_ring.netbufs_ring[0]));
 }
 
 static int __ath10k_htt_rx_ring_fill_n(struct ath10k_htt *htt, int num)
 {
         struct htt_rx_desc *rx_desc;
+        struct ath10k_skb_rxcb *rxcb;
         struct sk_buff *skb;
         dma_addr_t paddr;
         int ret = 0, idx;
 
+        /* The Full Rx Reorder firmware has no way of telling the host
+         * implicitly when it copied HTT Rx Ring buffers to MAC Rx Ring.
+         * To keep things simple make sure ring is always half empty. This
+         * guarantees there'll be no replenishment overruns possible.
+         */
+        BUILD_BUG_ON(HTT_RX_RING_FILL_LEVEL >= HTT_RX_RING_SIZE / 2);
+
         idx = __le32_to_cpu(*htt->rx_ring.alloc_idx.vaddr);
         while (num > 0) {
                 skb = dev_alloc_skb(HTT_RX_BUF_SIZE + HTT_RX_DESC_ALIGN);
@@ -86,17 +125,29 @@ static int __ath10k_htt_rx_ring_fill_n(struct ath10k_htt *htt, int num)
                         goto fail;
                 }
 
-                ATH10K_SKB_CB(skb)->paddr = paddr;
+                rxcb = ATH10K_SKB_RXCB(skb);
+                rxcb->paddr = paddr;
                 htt->rx_ring.netbufs_ring[idx] = skb;
                 htt->rx_ring.paddrs_ring[idx] = __cpu_to_le32(paddr);
                 htt->rx_ring.fill_cnt++;
 
+                if (htt->rx_ring.in_ord_rx) {
+                        hash_add(htt->rx_ring.skb_table,
+                                 &ATH10K_SKB_RXCB(skb)->hlist,
+                                 (u32)paddr);
+                }
+
                 num--;
                 idx++;
                 idx &= htt->rx_ring.size_mask;
         }
 
 fail:
+        /*
+         * Make sure the rx buffer is updated before available buffer
+         * index to avoid any potential rx ring corruption.
+         */
+        mb();
         *htt->rx_ring.alloc_idx.vaddr = __cpu_to_le32(idx);
         return ret;
 }
@@ -153,22 +204,20 @@ static void ath10k_htt_rx_ring_refill_retry(unsigned long arg)
         ath10k_htt_rx_msdu_buff_replenish(htt);
 }
 
-static void ath10k_htt_rx_ring_clean_up(struct ath10k_htt *htt)
+int ath10k_htt_rx_ring_refill(struct ath10k *ar)
 {
-        struct sk_buff *skb;
-        int i;
+        struct ath10k_htt *htt = &ar->htt;
+        int ret;
 
-        for (i = 0; i < htt->rx_ring.size; i++) {
-                skb = htt->rx_ring.netbufs_ring[i];
-                if (!skb)
-                        continue;
+        spin_lock_bh(&htt->rx_ring.lock);
+        ret = ath10k_htt_rx_ring_fill_n(htt, (htt->rx_ring.fill_level -
+                                              htt->rx_ring.fill_cnt));
+        spin_unlock_bh(&htt->rx_ring.lock);
 
-                dma_unmap_single(htt->ar->dev, ATH10K_SKB_CB(skb)->paddr,
-                                 skb->len + skb_tailroom(skb),
-                                 DMA_FROM_DEVICE);
-                dev_kfree_skb_any(skb);
-                htt->rx_ring.netbufs_ring[i] = NULL;
-        }
+        if (ret)
+                ath10k_htt_rx_ring_free(htt);
+
+        return ret;
 }
 
 void ath10k_htt_rx_free(struct ath10k_htt *htt)
@@ -179,8 +228,9 @@ void ath10k_htt_rx_free(struct ath10k_htt *htt)
 
         skb_queue_purge(&htt->tx_compl_q);
         skb_queue_purge(&htt->rx_compl_q);
+        skb_queue_purge(&htt->rx_in_ord_compl_q);
 
-        ath10k_htt_rx_ring_clean_up(htt);
+        ath10k_htt_rx_ring_free(htt);
 
         dma_free_coherent(htt->ar->dev,
                           (htt->rx_ring.size *
@@ -212,6 +262,7 @@ static inline struct sk_buff *ath10k_htt_rx_netbuf_pop(struct ath10k_htt *htt)
         idx = htt->rx_ring.sw_rd_idx.msdu_payld;
         msdu = htt->rx_ring.netbufs_ring[idx];
         htt->rx_ring.netbufs_ring[idx] = NULL;
+        htt->rx_ring.paddrs_ring[idx] = 0;
 
         idx++;
         idx &= htt->rx_ring.size_mask;
@@ -219,7 +270,7 @@ static inline struct sk_buff *ath10k_htt_rx_netbuf_pop(struct ath10k_htt *htt)
         htt->rx_ring.fill_cnt--;
 
         dma_unmap_single(htt->ar->dev,
-                         ATH10K_SKB_CB(msdu)->paddr,
+                         ATH10K_SKB_RXCB(msdu)->paddr,
                          msdu->len + skb_tailroom(msdu),
                          DMA_FROM_DEVICE);
         ath10k_dbg_dump(ar, ATH10K_DBG_HTT_DUMP, NULL, "htt rx netbuf pop: ",
@@ -379,6 +430,82 @@ static void ath10k_htt_rx_replenish_task(unsigned long ptr)
         ath10k_htt_rx_msdu_buff_replenish(htt);
 }
 
+static struct sk_buff *ath10k_htt_rx_pop_paddr(struct ath10k_htt *htt,
+                                               u32 paddr)
+{
+        struct ath10k *ar = htt->ar;
+        struct ath10k_skb_rxcb *rxcb;
+        struct sk_buff *msdu;
+
+        lockdep_assert_held(&htt->rx_ring.lock);
+
+        msdu = ath10k_htt_rx_find_skb_paddr(ar, paddr);
+        if (!msdu)
+                return NULL;
+
+        rxcb = ATH10K_SKB_RXCB(msdu);
+        hash_del(&rxcb->hlist);
+        htt->rx_ring.fill_cnt--;
+
+        dma_unmap_single(htt->ar->dev, rxcb->paddr,
+                         msdu->len + skb_tailroom(msdu),
+                         DMA_FROM_DEVICE);
+        ath10k_dbg_dump(ar, ATH10K_DBG_HTT_DUMP, NULL, "htt rx netbuf pop: ",
+                        msdu->data, msdu->len + skb_tailroom(msdu));
+
+        return msdu;
+}
+
+static int ath10k_htt_rx_pop_paddr_list(struct ath10k_htt *htt,
+                                        struct htt_rx_in_ord_ind *ev,
+                                        struct sk_buff_head *list)
+{
+        struct ath10k *ar = htt->ar;
+        struct htt_rx_in_ord_msdu_desc *msdu_desc = ev->msdu_descs;
+        struct htt_rx_desc *rxd;
+        struct sk_buff *msdu;
+        int msdu_count;
+        bool is_offload;
+        u32 paddr;
+
+        lockdep_assert_held(&htt->rx_ring.lock);
+
+        msdu_count = __le16_to_cpu(ev->msdu_count);
+        is_offload = !!(ev->info & HTT_RX_IN_ORD_IND_INFO_OFFLOAD_MASK);
+
+        while (msdu_count--) {
+                paddr = __le32_to_cpu(msdu_desc->msdu_paddr);
+
+                msdu = ath10k_htt_rx_pop_paddr(htt, paddr);
+                if (!msdu) {
+                        __skb_queue_purge(list);
+                        return -ENOENT;
+                }
+
+                __skb_queue_tail(list, msdu);
+
+                if (!is_offload) {
+                        rxd = (void *)msdu->data;
+
+                        trace_ath10k_htt_rx_desc(ar, rxd, sizeof(*rxd));
+
+                        skb_put(msdu, sizeof(*rxd));
+                        skb_pull(msdu, sizeof(*rxd));
+                        skb_put(msdu, __le16_to_cpu(msdu_desc->msdu_len));
+
+                        if (!(__le32_to_cpu(rxd->attention.flags) &
+                              RX_ATTENTION_FLAGS_MSDU_DONE)) {
+                                ath10k_warn(htt->ar, "tried to pop an incomplete frame, oops!\n");
+                                return -EIO;
+                        }
+                }
+
+                msdu_desc++;
+        }
+
+        return 0;
+}
+
 int ath10k_htt_rx_alloc(struct ath10k_htt *htt)
 {
         struct ath10k *ar = htt->ar;
@@ -424,7 +551,7 @@ int ath10k_htt_rx_alloc(struct ath10k_htt *htt)
 
         htt->rx_ring.alloc_idx.vaddr = vaddr;
         htt->rx_ring.alloc_idx.paddr = paddr;
-        htt->rx_ring.sw_rd_idx.msdu_payld = 0;
+        htt->rx_ring.sw_rd_idx.msdu_payld = htt->rx_ring.size_mask;
         *htt->rx_ring.alloc_idx.vaddr = 0;
 
         /* Initialize the Rx refill retry timer */
@@ -433,14 +560,15 @@ int ath10k_htt_rx_alloc(struct ath10k_htt *htt)
         spin_lock_init(&htt->rx_ring.lock);
 
         htt->rx_ring.fill_cnt = 0;
-        if (__ath10k_htt_rx_ring_fill_n(htt, htt->rx_ring.fill_level))
-                goto err_fill_ring;
+        htt->rx_ring.sw_rd_idx.msdu_payld = 0;
+        hash_init(htt->rx_ring.skb_table);
 
         tasklet_init(&htt->rx_replenish_task, ath10k_htt_rx_replenish_task,
                      (unsigned long)htt);
 
         skb_queue_head_init(&htt->tx_compl_q);
         skb_queue_head_init(&htt->rx_compl_q);
+        skb_queue_head_init(&htt->rx_in_ord_compl_q);
 
         tasklet_init(&htt->txrx_compl_task, ath10k_htt_txrx_compl_task,
                      (unsigned long)htt);
@@ -449,12 +577,6 @@ int ath10k_htt_rx_alloc(struct ath10k_htt *htt)
                    htt->rx_ring.size, htt->rx_ring.fill_level);
         return 0;
 
-err_fill_ring:
-        ath10k_htt_rx_ring_free(htt);
-        dma_free_coherent(htt->ar->dev,
-                          sizeof(*htt->rx_ring.alloc_idx.vaddr),
-                          htt->rx_ring.alloc_idx.vaddr,
-                          htt->rx_ring.alloc_idx.paddr);
 err_dma_idx:
         dma_free_coherent(htt->ar->dev,
                           (htt->rx_ring.size *
@@ -691,7 +813,7 @@ static void ath10k_htt_rx_h_mactime(struct ath10k *ar,
          *
          * FIXME: Can we get/compute 64bit TSF?
          */
-        status->mactime = __le32_to_cpu(rxd->ppdu_end.tsf_timestamp);
+        status->mactime = __le32_to_cpu(rxd->ppdu_end.common.tsf_timestamp);
         status->flag |= RX_FLAG_MACTIME_END;
 }
 
@@ -1578,6 +1700,194 @@ static void ath10k_htt_rx_delba(struct ath10k *ar, struct htt_resp *resp)
         spin_unlock_bh(&ar->data_lock);
 }
 
+static int ath10k_htt_rx_extract_amsdu(struct sk_buff_head *list,
+                                       struct sk_buff_head *amsdu)
+{
+        struct sk_buff *msdu;
+        struct htt_rx_desc *rxd;
+
+        if (skb_queue_empty(list))
+                return -ENOBUFS;
+
+        if (WARN_ON(!skb_queue_empty(amsdu)))
+                return -EINVAL;
+
+        while ((msdu = __skb_dequeue(list))) {
+                __skb_queue_tail(amsdu, msdu);
+
+                rxd = (void *)msdu->data - sizeof(*rxd);
+                if (rxd->msdu_end.info0 &
+                    __cpu_to_le32(RX_MSDU_END_INFO0_LAST_MSDU))
+                        break;
+        }
+
+        msdu = skb_peek_tail(amsdu);
+        rxd = (void *)msdu->data - sizeof(*rxd);
+        if (!(rxd->msdu_end.info0 &
+              __cpu_to_le32(RX_MSDU_END_INFO0_LAST_MSDU))) {
+                skb_queue_splice_init(amsdu, list);
+                return -EAGAIN;
+        }
+
+        return 0;
+}
+
+static void ath10k_htt_rx_h_rx_offload_prot(struct ieee80211_rx_status *status,
+                                            struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+
+        if (!ieee80211_has_protected(hdr->frame_control))
+                return;
+
+        /* Offloaded frames are already decrypted but firmware insists they are
+         * protected in the 802.11 header. Strip the flag.  Otherwise mac80211
+         * will drop the frame.
+         */
+
+        hdr->frame_control &= ~__cpu_to_le16(IEEE80211_FCTL_PROTECTED);
+        status->flag |= RX_FLAG_DECRYPTED |
+                        RX_FLAG_IV_STRIPPED |
+                        RX_FLAG_MMIC_STRIPPED;
+}
+
+static void ath10k_htt_rx_h_rx_offload(struct ath10k *ar,
+                                       struct sk_buff_head *list)
+{
+        struct ath10k_htt *htt = &ar->htt;
+        struct ieee80211_rx_status *status = &htt->rx_status;
+        struct htt_rx_offload_msdu *rx;
+        struct sk_buff *msdu;
+        size_t offset;
+
+        while ((msdu = __skb_dequeue(list))) {
+                /* Offloaded frames don't have Rx descriptor. Instead they have
+                 * a short meta information header.
+                 */
+
+                rx = (void *)msdu->data;
+
+                skb_put(msdu, sizeof(*rx));
+                skb_pull(msdu, sizeof(*rx));
+
+                if (skb_tailroom(msdu) < __le16_to_cpu(rx->msdu_len)) {
+                        ath10k_warn(ar, "dropping frame: offloaded rx msdu is too long!\n");
+                        dev_kfree_skb_any(msdu);
+                        continue;
+                }
+
+                skb_put(msdu, __le16_to_cpu(rx->msdu_len));
+
+                /* Offloaded rx header length isn't multiple of 2 nor 4 so the
+                 * actual payload is unaligned. Align the frame.  Otherwise
+                 * mac80211 complains.  This shouldn't reduce performance much
+                 * because these offloaded frames are rare.
+                 */
+                offset = 4 - ((unsigned long)msdu->data & 3);
+                skb_put(msdu, offset);
+                memmove(msdu->data + offset, msdu->data, msdu->len);
+                skb_pull(msdu, offset);
+
+                /* FIXME: The frame is NWifi. Re-construct QoS Control
+                 * if possible later.
+                 */
+
+                memset(status, 0, sizeof(*status));
+                status->flag |= RX_FLAG_NO_SIGNAL_VAL;
+
+                ath10k_htt_rx_h_rx_offload_prot(status, msdu);
+                ath10k_htt_rx_h_channel(ar, status);
+                ath10k_process_rx(ar, status, msdu);
+        }
+}
+
+static void ath10k_htt_rx_in_ord_ind(struct ath10k *ar, struct sk_buff *skb)
+{
+        struct ath10k_htt *htt = &ar->htt;
+        struct htt_resp *resp = (void *)skb->data;
+        struct ieee80211_rx_status *status = &htt->rx_status;
+        struct sk_buff_head list;
+        struct sk_buff_head amsdu;
+        u16 peer_id;
+        u16 msdu_count;
+        u8 vdev_id;
+        u8 tid;
+        bool offload;
+        bool frag;
+        int ret;
+
+        lockdep_assert_held(&htt->rx_ring.lock);
+
+        if (htt->rx_confused)
+                return;
+
+        skb_pull(skb, sizeof(resp->hdr));
+        skb_pull(skb, sizeof(resp->rx_in_ord_ind));
+
+        peer_id = __le16_to_cpu(resp->rx_in_ord_ind.peer_id);
+        msdu_count = __le16_to_cpu(resp->rx_in_ord_ind.msdu_count);
+        vdev_id = resp->rx_in_ord_ind.vdev_id;
+        tid = SM(resp->rx_in_ord_ind.info, HTT_RX_IN_ORD_IND_INFO_TID);
+        offload = !!(resp->rx_in_ord_ind.info &
+                        HTT_RX_IN_ORD_IND_INFO_OFFLOAD_MASK);
+        frag = !!(resp->rx_in_ord_ind.info & HTT_RX_IN_ORD_IND_INFO_FRAG_MASK);
+
+        ath10k_dbg(ar, ATH10K_DBG_HTT,
+                   "htt rx in ord vdev %i peer %i tid %i offload %i frag %i msdu count %i\n",
+                   vdev_id, peer_id, tid, offload, frag, msdu_count);
+
+        if (skb->len < msdu_count * sizeof(*resp->rx_in_ord_ind.msdu_descs)) {
+                ath10k_warn(ar, "dropping invalid in order rx indication\n");
+                return;
+        }
+
+        /* The event can deliver more than 1 A-MSDU. Each A-MSDU is later
+         * extracted and processed.
+         */
+        __skb_queue_head_init(&list);
+        ret = ath10k_htt_rx_pop_paddr_list(htt, &resp->rx_in_ord_ind, &list);
+        if (ret < 0) {
+                ath10k_warn(ar, "failed to pop paddr list: %d\n", ret);
+                htt->rx_confused = true;
+                return;
+        }
+
+        /* Offloaded frames are very different and need to be handled
+         * separately.
+         */
+        if (offload)
+                ath10k_htt_rx_h_rx_offload(ar, &list);
+
+        while (!skb_queue_empty(&list)) {
+                __skb_queue_head_init(&amsdu);
+                ret = ath10k_htt_rx_extract_amsdu(&list, &amsdu);
+                switch (ret) {
+                case 0:
+                        /* Note: The in-order indication may report interleaved
+                         * frames from different PPDUs meaning reported rx rate
+                         * to mac80211 isn't accurate/reliable. It's still
+                         * better to report something than nothing though. This
+                         * should still give an idea about rx rate to the user.
+                         */
+                        ath10k_htt_rx_h_ppdu(ar, &amsdu, status);
+                        ath10k_htt_rx_h_filter(ar, &amsdu, status);
+                        ath10k_htt_rx_h_mpdu(ar, &amsdu, status);
+                        ath10k_htt_rx_h_deliver(ar, &amsdu, status);
+                        break;
+                case -EAGAIN:
+                        /* fall through */
+                default:
+                        /* Should not happen. */
+                        ath10k_warn(ar, "failed to extract amsdu: %d\n", ret);
+                        htt->rx_confused = true;
+                        __skb_queue_purge(&list);
+                        return;
+                }
+        }
+
+        tasklet_schedule(&htt->rx_replenish_task);
+}
+
 void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb)
 {
         struct ath10k_htt *htt = &ar->htt;
@@ -1700,6 +2010,20 @@ void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb)
                  */
                 break;
         }
+        case HTT_T2H_MSG_TYPE_RX_IN_ORD_PADDR_IND: {
+                spin_lock_bh(&htt->rx_ring.lock);
+                __skb_queue_tail(&htt->rx_in_ord_compl_q, skb);
+                spin_unlock_bh(&htt->rx_ring.lock);
+                tasklet_schedule(&htt->txrx_compl_task);
+                return;
+        }
+        case HTT_T2H_MSG_TYPE_TX_CREDIT_UPDATE_IND:
+                /* FIXME: This WMI-TLV event is overlapping with 10.2
+                 * CHAN_CHANGE - both being 0xF. Neither is being used in
+                 * practice so no immediate action is necessary. Nevertheless
+                 * HTT may need an abstraction layer like WMI has one day.
+                 */
+                break;
         default:
                 ath10k_warn(ar, "htt event (%d) not handled\n",
                             resp->hdr.msg_type);
@@ -1715,6 +2039,7 @@ void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb)
 static void ath10k_htt_txrx_compl_task(unsigned long ptr)
 {
         struct ath10k_htt *htt = (struct ath10k_htt *)ptr;
+        struct ath10k *ar = htt->ar;
         struct htt_resp *resp;
         struct sk_buff *skb;
 
@@ -1731,5 +2056,10 @@ static void ath10k_htt_txrx_compl_task(unsigned long ptr)
                 ath10k_htt_rx_handler(htt, &resp->rx_ind);
                 dev_kfree_skb_any(skb);
         }
+
+        while ((skb = __skb_dequeue(&htt->rx_in_ord_compl_q))) {
+                ath10k_htt_rx_in_ord_ind(ar, skb);
+                dev_kfree_skb_any(skb);
+        }
         spin_unlock_bh(&htt->rx_ring.lock);
 }
diff --git a/drivers/net/wireless/ath/ath10k/htt_tx.c b/drivers/net/wireless/ath/ath10k/htt_tx.c
index 4bc51d8a14a3..cbd2bc9e6202 100644
--- a/drivers/net/wireless/ath/ath10k/htt_tx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_tx.c
@@ -56,21 +56,18 @@ exit:
         return ret;
 }
 
-int ath10k_htt_tx_alloc_msdu_id(struct ath10k_htt *htt)
+int ath10k_htt_tx_alloc_msdu_id(struct ath10k_htt *htt, struct sk_buff *skb)
 {
         struct ath10k *ar = htt->ar;
-        int msdu_id;
+        int ret;
 
         lockdep_assert_held(&htt->tx_lock);
 
-        msdu_id = find_first_zero_bit(htt->used_msdu_ids,
-                                      htt->max_num_pending_tx);
-        if (msdu_id == htt->max_num_pending_tx)
-                return -ENOBUFS;
+        ret = idr_alloc(&htt->pending_tx, skb, 0, 0x10000, GFP_ATOMIC);
+
+        ath10k_dbg(ar, ATH10K_DBG_HTT, "htt tx alloc msdu_id %d\n", ret);
 
-        ath10k_dbg(ar, ATH10K_DBG_HTT, "htt tx alloc msdu_id %d\n", msdu_id);
-        __set_bit(msdu_id, htt->used_msdu_ids);
-        return msdu_id;
+        return ret;
 }
 
 void ath10k_htt_tx_free_msdu_id(struct ath10k_htt *htt, u16 msdu_id)
@@ -79,79 +76,53 @@ void ath10k_htt_tx_free_msdu_id(struct ath10k_htt *htt, u16 msdu_id)
 
         lockdep_assert_held(&htt->tx_lock);
 
-        if (!test_bit(msdu_id, htt->used_msdu_ids))
-                ath10k_warn(ar, "trying to free unallocated msdu_id %d\n",
-                            msdu_id);
-
         ath10k_dbg(ar, ATH10K_DBG_HTT, "htt tx free msdu_id %hu\n", msdu_id);
-        __clear_bit(msdu_id, htt->used_msdu_ids);
+
+        idr_remove(&htt->pending_tx, msdu_id);
 }
 
 int ath10k_htt_tx_alloc(struct ath10k_htt *htt)
 {
         struct ath10k *ar = htt->ar;
 
-        spin_lock_init(&htt->tx_lock);
-
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, htt->ar->fw_features))
-                htt->max_num_pending_tx = TARGET_10X_NUM_MSDU_DESC;
-        else
-                htt->max_num_pending_tx = TARGET_NUM_MSDU_DESC;
-
         ath10k_dbg(ar, ATH10K_DBG_BOOT, "htt tx max num pending tx %d\n",
                    htt->max_num_pending_tx);
 
-        htt->pending_tx = kzalloc(sizeof(*htt->pending_tx) *
-                                  htt->max_num_pending_tx, GFP_KERNEL);
-        if (!htt->pending_tx)
-                return -ENOMEM;
-
-        htt->used_msdu_ids = kzalloc(sizeof(unsigned long) *
-                                     BITS_TO_LONGS(htt->max_num_pending_tx),
-                                     GFP_KERNEL);
-        if (!htt->used_msdu_ids) {
-                kfree(htt->pending_tx);
-                return -ENOMEM;
-        }
+        spin_lock_init(&htt->tx_lock);
+        idr_init(&htt->pending_tx);
 
         htt->tx_pool = dma_pool_create("ath10k htt tx pool", htt->ar->dev,
                                        sizeof(struct ath10k_htt_txbuf), 4, 0);
         if (!htt->tx_pool) {
-                kfree(htt->used_msdu_ids);
-                kfree(htt->pending_tx);
+                idr_destroy(&htt->pending_tx);
                 return -ENOMEM;
         }
 
         return 0;
 }
 
-static void ath10k_htt_tx_free_pending(struct ath10k_htt *htt)
+static int ath10k_htt_tx_clean_up_pending(int msdu_id, void *skb, void *ctx)
 {
-        struct ath10k *ar = htt->ar;
+        struct ath10k *ar = ctx;
+        struct ath10k_htt *htt = &ar->htt;
         struct htt_tx_done tx_done = {0};
-        int msdu_id;
-
-        spin_lock_bh(&htt->tx_lock);
-        for (msdu_id = 0; msdu_id < htt->max_num_pending_tx; msdu_id++) {
-                if (!test_bit(msdu_id, htt->used_msdu_ids))
-                        continue;
 
-                ath10k_dbg(ar, ATH10K_DBG_HTT, "force cleanup msdu_id %hu\n",
-                           msdu_id);
+        ath10k_dbg(ar, ATH10K_DBG_HTT, "force cleanup msdu_id %hu\n", msdu_id);
 
-                tx_done.discard = 1;
-                tx_done.msdu_id = msdu_id;
+        tx_done.discard = 1;
+        tx_done.msdu_id = msdu_id;
 
-                ath10k_txrx_tx_unref(htt, &tx_done);
-        }
+        spin_lock_bh(&htt->tx_lock);
+        ath10k_txrx_tx_unref(htt, &tx_done);
         spin_unlock_bh(&htt->tx_lock);
+
+        return 0;
 }
 
 void ath10k_htt_tx_free(struct ath10k_htt *htt)
 {
-        ath10k_htt_tx_free_pending(htt);
-        kfree(htt->pending_tx);
-        kfree(htt->used_msdu_ids);
+        idr_for_each(&htt->pending_tx, ath10k_htt_tx_clean_up_pending, htt->ar);
+        idr_destroy(&htt->pending_tx);
         dma_pool_destroy(htt->tx_pool);
 }
 
@@ -383,13 +354,12 @@ int ath10k_htt_mgmt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
         len += sizeof(cmd->mgmt_tx);
 
         spin_lock_bh(&htt->tx_lock);
-        res = ath10k_htt_tx_alloc_msdu_id(htt);
+        res = ath10k_htt_tx_alloc_msdu_id(htt, msdu);
         if (res < 0) {
                 spin_unlock_bh(&htt->tx_lock);
                 goto err_tx_dec;
         }
         msdu_id = res;
-        htt->pending_tx[msdu_id] = msdu;
         spin_unlock_bh(&htt->tx_lock);
 
         txdesc = ath10k_htc_alloc_skb(ar, len);
@@ -428,7 +398,6 @@ err_free_txdesc:
         dev_kfree_skb_any(txdesc);
 err_free_msdu_id:
         spin_lock_bh(&htt->tx_lock);
-        htt->pending_tx[msdu_id] = NULL;
         ath10k_htt_tx_free_msdu_id(htt, msdu_id);
         spin_unlock_bh(&htt->tx_lock);
 err_tx_dec:
@@ -460,13 +429,12 @@ int ath10k_htt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
                 goto err;
 
         spin_lock_bh(&htt->tx_lock);
-        res = ath10k_htt_tx_alloc_msdu_id(htt);
+        res = ath10k_htt_tx_alloc_msdu_id(htt, msdu);
         if (res < 0) {
                 spin_unlock_bh(&htt->tx_lock);
                 goto err_tx_dec;
         }
         msdu_id = res;
-        htt->pending_tx[msdu_id] = msdu;
         spin_unlock_bh(&htt->tx_lock);
 
         prefetch_len = min(htt->prefetch_len, msdu->len);
@@ -480,10 +448,18 @@ int ath10k_htt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
 
         skb_cb->htt.txbuf = dma_pool_alloc(htt->tx_pool, GFP_ATOMIC,
                                            &paddr);
-        if (!skb_cb->htt.txbuf)
+        if (!skb_cb->htt.txbuf) {
+                res = -ENOMEM;
                 goto err_free_msdu_id;
+        }
         skb_cb->htt.txbuf_paddr = paddr;
 
+        if ((ieee80211_is_action(hdr->frame_control) ||
+             ieee80211_is_deauth(hdr->frame_control) ||
+             ieee80211_is_disassoc(hdr->frame_control)) &&
+             ieee80211_has_protected(hdr->frame_control))
+                skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
+
         skb_cb->paddr = dma_map_single(dev, msdu->data, msdu->len,
                                        DMA_TO_DEVICE);
         res = dma_mapping_error(dev, skb_cb->paddr);
@@ -539,8 +515,10 @@ int ath10k_htt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
 
         flags1 |= SM((u16)vdev_id, HTT_DATA_TX_DESC_FLAGS1_VDEV_ID);
         flags1 |= SM((u16)tid, HTT_DATA_TX_DESC_FLAGS1_EXT_TID);
-        flags1 |= HTT_DATA_TX_DESC_FLAGS1_CKSUM_L3_OFFLOAD;
-        flags1 |= HTT_DATA_TX_DESC_FLAGS1_CKSUM_L4_OFFLOAD;
+        if (msdu->ip_summed == CHECKSUM_PARTIAL) {
+                flags1 |= HTT_DATA_TX_DESC_FLAGS1_CKSUM_L3_OFFLOAD;
+                flags1 |= HTT_DATA_TX_DESC_FLAGS1_CKSUM_L4_OFFLOAD;
+        }
 
         /* Prevent firmware from sending up tx inspection requests. There's
          * nothing ath10k can do with frames requested for inspection so force
@@ -598,7 +576,6 @@ err_free_txbuf:
                       skb_cb->htt.txbuf_paddr);
 err_free_msdu_id:
         spin_lock_bh(&htt->tx_lock);
-        htt->pending_tx[msdu_id] = NULL;
         ath10k_htt_tx_free_msdu_id(htt, msdu_id);
         spin_unlock_bh(&htt->tx_lock);
 err_tx_dec:
diff --git a/drivers/net/wireless/ath/ath10k/hw.c b/drivers/net/wireless/ath/ath10k/hw.c
new file mode 100644
index 000000000000..839a8791fb9e
--- /dev/null
+++ b/drivers/net/wireless/ath/ath10k/hw.c
@@ -0,0 +1,58 @@
+/*
+ * Copyright (c) 2014-2015 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/types.h>
+#include "hw.h"
+
+const struct ath10k_hw_regs qca988x_regs = {
+        .rtc_state_cold_reset_mask      = 0x00000400,
+        .rtc_soc_base_address           = 0x00004000,
+        .rtc_wmac_base_address          = 0x00005000,
+        .soc_core_base_address          = 0x00009000,
+        .ce_wrapper_base_address        = 0x00057000,
+        .ce0_base_address               = 0x00057400,
+        .ce1_base_address               = 0x00057800,
+        .ce2_base_address               = 0x00057c00,
+        .ce3_base_address               = 0x00058000,
+        .ce4_base_address               = 0x00058400,
+        .ce5_base_address               = 0x00058800,
+        .ce6_base_address               = 0x00058c00,
+        .ce7_base_address               = 0x00059000,
+        .soc_reset_control_si0_rst_mask = 0x00000001,
+        .soc_reset_control_ce_rst_mask  = 0x00040000,
+        .soc_chip_id_address            = 0x00ec,
+        .scratch_3_address              = 0x0030,
+};
+
+const struct ath10k_hw_regs qca6174_regs = {
+        .rtc_state_cold_reset_mask              = 0x00002000,
+        .rtc_soc_base_address                   = 0x00000800,
+        .rtc_wmac_base_address                  = 0x00001000,
+        .soc_core_base_address                  = 0x0003a000,
+        .ce_wrapper_base_address                = 0x00034000,
+        .ce0_base_address                       = 0x00034400,
+        .ce1_base_address                       = 0x00034800,
+        .ce2_base_address                       = 0x00034c00,
+        .ce3_base_address                       = 0x00035000,
+        .ce4_base_address                       = 0x00035400,
+        .ce5_base_address                       = 0x00035800,
+        .ce6_base_address                       = 0x00035c00,
+        .ce7_base_address                       = 0x00036000,
+        .soc_reset_control_si0_rst_mask         = 0x00000000,
+        .soc_reset_control_ce_rst_mask          = 0x00000001,
+        .soc_chip_id_address                    = 0x000f0,
+        .scratch_3_address                      = 0x0028,
+};
diff --git a/drivers/net/wireless/ath/ath10k/hw.h b/drivers/net/wireless/ath/ath10k/hw.h
index dfedfd0e0f34..460771fcfe9e 100644
--- a/drivers/net/wireless/ath/ath10k/hw.h
+++ b/drivers/net/wireless/ath/ath10k/hw.h
@@ -34,9 +34,50 @@
 #define QCA988X_HW_2_0_BOARD_DATA_FILE  "board.bin"
 #define QCA988X_HW_2_0_PATCH_LOAD_ADDR  0x1234
 
+/* QCA6174 target BMI version signatures */
+#define QCA6174_HW_1_0_VERSION          0x05000000
+#define QCA6174_HW_1_1_VERSION          0x05000001
+#define QCA6174_HW_1_3_VERSION          0x05000003
+#define QCA6174_HW_2_1_VERSION          0x05010000
+#define QCA6174_HW_3_0_VERSION          0x05020000
+#define QCA6174_HW_3_2_VERSION          0x05030000
+
+enum qca6174_pci_rev {
+        QCA6174_PCI_REV_1_1 = 0x11,
+        QCA6174_PCI_REV_1_3 = 0x13,
+        QCA6174_PCI_REV_2_0 = 0x20,
+        QCA6174_PCI_REV_3_0 = 0x30,
+};
+
+enum qca6174_chip_id_rev {
+        QCA6174_HW_1_0_CHIP_ID_REV = 0,
+        QCA6174_HW_1_1_CHIP_ID_REV = 1,
+        QCA6174_HW_1_3_CHIP_ID_REV = 2,
+        QCA6174_HW_2_1_CHIP_ID_REV = 4,
+        QCA6174_HW_2_2_CHIP_ID_REV = 5,
+        QCA6174_HW_3_0_CHIP_ID_REV = 8,
+        QCA6174_HW_3_1_CHIP_ID_REV = 9,
+        QCA6174_HW_3_2_CHIP_ID_REV = 10,
+};
+
+#define QCA6174_HW_2_1_FW_DIR           "ath10k/QCA6174/hw2.1"
+#define QCA6174_HW_2_1_FW_FILE          "firmware.bin"
+#define QCA6174_HW_2_1_OTP_FILE         "otp.bin"
+#define QCA6174_HW_2_1_BOARD_DATA_FILE  "board.bin"
+#define QCA6174_HW_2_1_PATCH_LOAD_ADDR  0x1234
+
+#define QCA6174_HW_3_0_FW_DIR           "ath10k/QCA6174/hw3.0"
+#define QCA6174_HW_3_0_FW_FILE          "firmware.bin"
+#define QCA6174_HW_3_0_OTP_FILE         "otp.bin"
+#define QCA6174_HW_3_0_BOARD_DATA_FILE  "board.bin"
+#define QCA6174_HW_3_0_PATCH_LOAD_ADDR  0x1234
+
 #define ATH10K_FW_API2_FILE             "firmware-2.bin"
 #define ATH10K_FW_API3_FILE             "firmware-3.bin"
 
+/* added support for ATH10K_FW_IE_WMI_OP_VERSION */
+#define ATH10K_FW_API4_FILE             "firmware-4.bin"
+
 #define ATH10K_FW_UTF_FILE              "utf.bin"
 
 /* includes also the null byte */
@@ -58,8 +99,57 @@ enum ath10k_fw_ie_type {
         ATH10K_FW_IE_FEATURES = 2,
         ATH10K_FW_IE_FW_IMAGE = 3,
         ATH10K_FW_IE_OTP_IMAGE = 4,
+
+        /* WMI "operations" interface version, 32 bit value. Supported from
+         * FW API 4 and above.
+         */
+        ATH10K_FW_IE_WMI_OP_VERSION = 5,
+};
+
+enum ath10k_fw_wmi_op_version {
+        ATH10K_FW_WMI_OP_VERSION_UNSET = 0,
+
+        ATH10K_FW_WMI_OP_VERSION_MAIN = 1,
+        ATH10K_FW_WMI_OP_VERSION_10_1 = 2,
+        ATH10K_FW_WMI_OP_VERSION_10_2 = 3,
+        ATH10K_FW_WMI_OP_VERSION_TLV = 4,
+        ATH10K_FW_WMI_OP_VERSION_10_2_4 = 5,
+
+        /* keep last */
+        ATH10K_FW_WMI_OP_VERSION_MAX,
+};
+
+enum ath10k_hw_rev {
+        ATH10K_HW_QCA988X,
+        ATH10K_HW_QCA6174,
+};
+
+struct ath10k_hw_regs {
+        u32 rtc_state_cold_reset_mask;
+        u32 rtc_soc_base_address;
+        u32 rtc_wmac_base_address;
+        u32 soc_core_base_address;
+        u32 ce_wrapper_base_address;
+        u32 ce0_base_address;
+        u32 ce1_base_address;
+        u32 ce2_base_address;
+        u32 ce3_base_address;
+        u32 ce4_base_address;
+        u32 ce5_base_address;
+        u32 ce6_base_address;
+        u32 ce7_base_address;
+        u32 soc_reset_control_si0_rst_mask;
+        u32 soc_reset_control_ce_rst_mask;
+        u32 soc_chip_id_address;
+        u32 scratch_3_address;
 };
 
+extern const struct ath10k_hw_regs qca988x_regs;
+extern const struct ath10k_hw_regs qca6174_regs;
+
+#define QCA_REV_988X(ar) ((ar)->hw_rev == ATH10K_HW_QCA988X)
+#define QCA_REV_6174(ar) ((ar)->hw_rev == ATH10K_HW_QCA6174)
+
 /* Known pecularities:
  *  - current FW doesn't support raw rx mode (last tested v599)
  *  - current FW dumps upon raw tx mode (last tested v599)
@@ -162,6 +252,18 @@ struct ath10k_pktlog_hdr {
 #define TARGET_10X_NUM_MSDU_DESC                (1024 + 400)
 #define TARGET_10X_MAX_FRAG_ENTRIES             0
 
+/* 10.2 parameters */
+#define TARGET_10_2_DMA_BURST_SIZE              1
+
+/* Target specific defines for WMI-TLV firmware */
+#define TARGET_TLV_NUM_VDEVS                    3
+#define TARGET_TLV_NUM_STATIONS                 32
+#define TARGET_TLV_NUM_PEERS                    ((TARGET_TLV_NUM_STATIONS) + \
+                                                 (TARGET_TLV_NUM_VDEVS) + \
+                                                 2)
+#define TARGET_TLV_NUM_TIDS                     ((TARGET_TLV_NUM_PEERS) * 2)
+#define TARGET_TLV_NUM_MSDU_DESC                (1024 + 32)
+
 /* Number of Copy Engines supported */
 #define CE_COUNT 8
 
@@ -192,7 +294,7 @@ struct ath10k_pktlog_hdr {
 /* as of IP3.7.1 */
 #define RTC_STATE_V_ON                          3
 
-#define RTC_STATE_COLD_RESET_MASK               0x00000400
+#define RTC_STATE_COLD_RESET_MASK               ar->regs->rtc_state_cold_reset_mask
 #define RTC_STATE_V_LSB                         0
 #define RTC_STATE_V_MASK                        0x00000007
 #define RTC_STATE_ADDRESS                       0x0000
@@ -201,12 +303,12 @@ struct ath10k_pktlog_hdr {
 #define PCIE_SOC_WAKE_RESET                     0x00000000
 #define SOC_GLOBAL_RESET_ADDRESS                0x0008
 
-#define RTC_SOC_BASE_ADDRESS                    0x00004000
-#define RTC_WMAC_BASE_ADDRESS                   0x00005000
+#define RTC_SOC_BASE_ADDRESS                    ar->regs->rtc_soc_base_address
+#define RTC_WMAC_BASE_ADDRESS                   ar->regs->rtc_wmac_base_address
 #define MAC_COEX_BASE_ADDRESS                   0x00006000
 #define BT_COEX_BASE_ADDRESS                    0x00007000
 #define SOC_PCIE_BASE_ADDRESS                   0x00008000
-#define SOC_CORE_BASE_ADDRESS                   0x00009000
+#define SOC_CORE_BASE_ADDRESS                   ar->regs->soc_core_base_address
 #define WLAN_UART_BASE_ADDRESS                  0x0000c000
 #define WLAN_SI_BASE_ADDRESS                    0x00010000
 #define WLAN_GPIO_BASE_ADDRESS                  0x00014000
@@ -215,23 +317,23 @@ struct ath10k_pktlog_hdr {
 #define EFUSE_BASE_ADDRESS                      0x00030000
 #define FPGA_REG_BASE_ADDRESS                   0x00039000
 #define WLAN_UART2_BASE_ADDRESS                 0x00054c00
-#define CE_WRAPPER_BASE_ADDRESS                 0x00057000
-#define CE0_BASE_ADDRESS                        0x00057400
-#define CE1_BASE_ADDRESS                        0x00057800
-#define CE2_BASE_ADDRESS                        0x00057c00
-#define CE3_BASE_ADDRESS                        0x00058000
-#define CE4_BASE_ADDRESS                        0x00058400
-#define CE5_BASE_ADDRESS                        0x00058800
-#define CE6_BASE_ADDRESS                        0x00058c00
-#define CE7_BASE_ADDRESS                        0x00059000
+#define CE_WRAPPER_BASE_ADDRESS                 ar->regs->ce_wrapper_base_address
+#define CE0_BASE_ADDRESS                        ar->regs->ce0_base_address
+#define CE1_BASE_ADDRESS                        ar->regs->ce1_base_address
+#define CE2_BASE_ADDRESS                        ar->regs->ce2_base_address
+#define CE3_BASE_ADDRESS                        ar->regs->ce3_base_address
+#define CE4_BASE_ADDRESS                        ar->regs->ce4_base_address
+#define CE5_BASE_ADDRESS                        ar->regs->ce5_base_address
+#define CE6_BASE_ADDRESS                        ar->regs->ce6_base_address
+#define CE7_BASE_ADDRESS                        ar->regs->ce7_base_address
 #define DBI_BASE_ADDRESS                        0x00060000
 #define WLAN_ANALOG_INTF_PCIE_BASE_ADDRESS      0x0006c000
 #define PCIE_LOCAL_BASE_ADDRESS                 0x00080000
 
 #define SOC_RESET_CONTROL_ADDRESS               0x00000000
 #define SOC_RESET_CONTROL_OFFSET                0x00000000
-#define SOC_RESET_CONTROL_SI0_RST_MASK          0x00000001
-#define SOC_RESET_CONTROL_CE_RST_MASK           0x00040000
+#define SOC_RESET_CONTROL_SI0_RST_MASK          ar->regs->soc_reset_control_si0_rst_mask
+#define SOC_RESET_CONTROL_CE_RST_MASK           ar->regs->soc_reset_control_ce_rst_mask
 #define SOC_RESET_CONTROL_CPU_WARM_RST_MASK     0x00000040
 #define SOC_CPU_CLOCK_OFFSET                    0x00000020
 #define SOC_CPU_CLOCK_STANDARD_LSB              0
@@ -245,7 +347,7 @@ struct ath10k_pktlog_hdr {
 #define SOC_LF_TIMER_CONTROL0_ADDRESS           0x00000050
 #define SOC_LF_TIMER_CONTROL0_ENABLE_MASK       0x00000004
 
-#define SOC_CHIP_ID_ADDRESS                     0x000000ec
+#define SOC_CHIP_ID_ADDRESS                     ar->regs->soc_chip_id_address
 #define SOC_CHIP_ID_REV_LSB                     8
 #define SOC_CHIP_ID_REV_MASK                    0x00000f00
 
@@ -301,7 +403,7 @@ struct ath10k_pktlog_hdr {
 #define PCIE_INTR_ENABLE_ADDRESS                0x0008
 #define PCIE_INTR_CAUSE_ADDRESS                 0x000c
 #define PCIE_INTR_CLR_ADDRESS                   0x0014
-#define SCRATCH_3_ADDRESS                       0x0030
+#define SCRATCH_3_ADDRESS                       ar->regs->scratch_3_address
 #define CPU_INTR_ADDRESS                        0x0010
 
 /* Firmware indications to the Host via SCRATCH_3 register. */
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index c4005670cba2..d6d2f0f00caa 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -27,6 +27,8 @@
 #include "htt.h"
 #include "txrx.h"
 #include "testmode.h"
+#include "wmi.h"
+#include "wmi-ops.h"
 
 /**********/
 /* Crypto */
@@ -35,7 +37,7 @@
 static int ath10k_send_key(struct ath10k_vif *arvif,
                            struct ieee80211_key_conf *key,
                            enum set_key_cmd cmd,
-                           const u8 *macaddr)
+                           const u8 *macaddr, bool def_idx)
 {
         struct ath10k *ar = arvif->ar;
         struct wmi_vdev_install_key_arg arg = {
@@ -56,10 +58,7 @@ static int ath10k_send_key(struct ath10k_vif *arvif,
         switch (key->cipher) {
         case WLAN_CIPHER_SUITE_CCMP:
                 arg.key_cipher = WMI_CIPHER_AES_CCM;
-                if (arvif->vdev_type == WMI_VDEV_TYPE_AP)
-                        key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV_MGMT;
-                else
-                        key->flags |= IEEE80211_KEY_FLAG_SW_MGMT_TX;
+                key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV_MGMT;
                 break;
         case WLAN_CIPHER_SUITE_TKIP:
                 arg.key_cipher = WMI_CIPHER_TKIP;
@@ -73,7 +72,13 @@ static int ath10k_send_key(struct ath10k_vif *arvif,
                  * Otherwise pairwise key must be set */
                 if (memcmp(macaddr, arvif->vif->addr, ETH_ALEN))
                         arg.key_flags = WMI_KEY_PAIRWISE;
+
+                if (def_idx)
+                        arg.key_flags |= WMI_KEY_TX_USAGE;
                 break;
+        case WLAN_CIPHER_SUITE_AES_CMAC:
+                /* this one needs to be done in software */
+                return 1;
         default:
                 ath10k_warn(ar, "cipher %d is not supported\n", key->cipher);
                 return -EOPNOTSUPP;
@@ -90,7 +95,7 @@ static int ath10k_send_key(struct ath10k_vif *arvif,
 static int ath10k_install_key(struct ath10k_vif *arvif,
                               struct ieee80211_key_conf *key,
                               enum set_key_cmd cmd,
-                              const u8 *macaddr)
+                              const u8 *macaddr, bool def_idx)
 {
         struct ath10k *ar = arvif->ar;
         int ret;
@@ -99,7 +104,7 @@ static int ath10k_install_key(struct ath10k_vif *arvif,
 
         reinit_completion(&ar->install_key_done);
 
-        ret = ath10k_send_key(arvif, key, cmd, macaddr);
+        ret = ath10k_send_key(arvif, key, cmd, macaddr, def_idx);
         if (ret)
                 return ret;
 
@@ -117,6 +122,7 @@ static int ath10k_install_peer_wep_keys(struct ath10k_vif *arvif,
         struct ath10k_peer *peer;
         int ret;
         int i;
+        bool def_idx;
 
         lockdep_assert_held(&ar->conf_mutex);
 
@@ -130,9 +136,14 @@ static int ath10k_install_peer_wep_keys(struct ath10k_vif *arvif,
         for (i = 0; i < ARRAY_SIZE(arvif->wep_keys); i++) {
                 if (arvif->wep_keys[i] == NULL)
                         continue;
+                /* set TX_USAGE flag for default key id */
+                if (arvif->def_wep_key_idx == i)
+                        def_idx = true;
+                else
+                        def_idx = false;
 
                 ret = ath10k_install_key(arvif, arvif->wep_keys[i], SET_KEY,
-                                         addr);
+                                         addr, def_idx);
                 if (ret)
                         return ret;
 
@@ -166,8 +177,9 @@ static int ath10k_clear_peer_keys(struct ath10k_vif *arvif,
                 if (peer->keys[i] == NULL)
                         continue;
 
+                /* key flags are not required to delete the key */
                 ret = ath10k_install_key(arvif, peer->keys[i],
-                                         DISABLE_KEY, addr);
+                                         DISABLE_KEY, addr, false);
                 if (ret && first_errno == 0)
                         first_errno = ret;
 
@@ -241,8 +253,8 @@ static int ath10k_clear_vdev_key(struct ath10k_vif *arvif,
 
                 if (i == ARRAY_SIZE(peer->keys))
                         break;
-
-                ret = ath10k_install_key(arvif, key, DISABLE_KEY, addr);
+                /* key flags are not required to delete the key */
+                ret = ath10k_install_key(arvif, key, DISABLE_KEY, addr, false);
                 if (ret && first_errno == 0)
                         first_errno = ret;
 
@@ -267,7 +279,10 @@ chan_to_phymode(const struct cfg80211_chan_def *chandef)
         case IEEE80211_BAND_2GHZ:
                 switch (chandef->width) {
                 case NL80211_CHAN_WIDTH_20_NOHT:
-                        phymode = MODE_11G;
+                        if (chandef->chan->flags & IEEE80211_CHAN_NO_OFDM)
+                                phymode = MODE_11B;
+                        else
+                                phymode = MODE_11G;
                         break;
                 case NL80211_CHAN_WIDTH_20:
                         phymode = MODE_11NG_HT20;
@@ -519,10 +534,14 @@ void ath10k_mac_vif_beacon_free(struct ath10k_vif *arvif)
                 dma_unmap_single(ar->dev, ATH10K_SKB_CB(arvif->beacon)->paddr,
                                  arvif->beacon->len, DMA_TO_DEVICE);
 
+        if (WARN_ON(arvif->beacon_state != ATH10K_BEACON_SCHEDULED &&
+                    arvif->beacon_state != ATH10K_BEACON_SENT))
+                return;
+
         dev_kfree_skb_any(arvif->beacon);
 
         arvif->beacon = NULL;
-        arvif->beacon_sent = false;
+        arvif->beacon_state = ATH10K_BEACON_SCHEDULED;
 }
 
 static void ath10k_mac_vif_beacon_cleanup(struct ath10k_vif *arvif)
@@ -962,6 +981,143 @@ static int ath10k_vdev_stop(struct ath10k_vif *arvif)
         return ret;
 }
 
+static int ath10k_mac_setup_bcn_p2p_ie(struct ath10k_vif *arvif,
+                                       struct sk_buff *bcn)
+{
+        struct ath10k *ar = arvif->ar;
+        struct ieee80211_mgmt *mgmt;
+        const u8 *p2p_ie;
+        int ret;
+
+        if (arvif->vdev_type != WMI_VDEV_TYPE_AP)
+                return 0;
+
+        if (arvif->vdev_subtype != WMI_VDEV_SUBTYPE_P2P_GO)
+                return 0;
+
+        mgmt = (void *)bcn->data;
+        p2p_ie = cfg80211_find_vendor_ie(WLAN_OUI_WFA, WLAN_OUI_TYPE_WFA_P2P,
+                                         mgmt->u.beacon.variable,
+                                         bcn->len - (mgmt->u.beacon.variable -
+                                                     bcn->data));
+        if (!p2p_ie)
+                return -ENOENT;
+
+        ret = ath10k_wmi_p2p_go_bcn_ie(ar, arvif->vdev_id, p2p_ie);
+        if (ret) {
+                ath10k_warn(ar, "failed to submit p2p go bcn ie for vdev %i: %d\n",
+                            arvif->vdev_id, ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+static int ath10k_mac_remove_vendor_ie(struct sk_buff *skb, unsigned int oui,
+                                       u8 oui_type, size_t ie_offset)
+{
+        size_t len;
+        const u8 *next;
+        const u8 *end;
+        u8 *ie;
+
+        if (WARN_ON(skb->len < ie_offset))
+                return -EINVAL;
+
+        ie = (u8 *)cfg80211_find_vendor_ie(oui, oui_type,
+                                           skb->data + ie_offset,
+                                           skb->len - ie_offset);
+        if (!ie)
+                return -ENOENT;
+
+        len = ie[1] + 2;
+        end = skb->data + skb->len;
+        next = ie + len;
+
+        if (WARN_ON(next > end))
+                return -EINVAL;
+
+        memmove(ie, next, end - next);
+        skb_trim(skb, skb->len - len);
+
+        return 0;
+}
+
+static int ath10k_mac_setup_bcn_tmpl(struct ath10k_vif *arvif)
+{
+        struct ath10k *ar = arvif->ar;
+        struct ieee80211_hw *hw = ar->hw;
+        struct ieee80211_vif *vif = arvif->vif;
+        struct ieee80211_mutable_offsets offs = {};
+        struct sk_buff *bcn;
+        int ret;
+
+        if (!test_bit(WMI_SERVICE_BEACON_OFFLOAD, ar->wmi.svc_map))
+                return 0;
+
+        bcn = ieee80211_beacon_get_template(hw, vif, &offs);
+        if (!bcn) {
+                ath10k_warn(ar, "failed to get beacon template from mac80211\n");
+                return -EPERM;
+        }
+
+        ret = ath10k_mac_setup_bcn_p2p_ie(arvif, bcn);
+        if (ret) {
+                ath10k_warn(ar, "failed to setup p2p go bcn ie: %d\n", ret);
+                kfree_skb(bcn);
+                return ret;
+        }
+
+        /* P2P IE is inserted by firmware automatically (as configured above)
+         * so remove it from the base beacon template to avoid duplicate P2P
+         * IEs in beacon frames.
+         */
+        ath10k_mac_remove_vendor_ie(bcn, WLAN_OUI_WFA, WLAN_OUI_TYPE_WFA_P2P,
+                                    offsetof(struct ieee80211_mgmt,
+                                             u.beacon.variable));
+
+        ret = ath10k_wmi_bcn_tmpl(ar, arvif->vdev_id, offs.tim_offset, bcn, 0,
+                                  0, NULL, 0);
+        kfree_skb(bcn);
+
+        if (ret) {
+                ath10k_warn(ar, "failed to submit beacon template command: %d\n",
+                            ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+static int ath10k_mac_setup_prb_tmpl(struct ath10k_vif *arvif)
+{
+        struct ath10k *ar = arvif->ar;
+        struct ieee80211_hw *hw = ar->hw;
+        struct ieee80211_vif *vif = arvif->vif;
+        struct sk_buff *prb;
+        int ret;
+
+        if (!test_bit(WMI_SERVICE_BEACON_OFFLOAD, ar->wmi.svc_map))
+                return 0;
+
+        prb = ieee80211_proberesp_get(hw, vif);
+        if (!prb) {
+                ath10k_warn(ar, "failed to get probe resp template from mac80211\n");
+                return -EPERM;
+        }
+
+        ret = ath10k_wmi_prb_tmpl(ar, arvif->vdev_id, prb);
+        kfree_skb(prb);
+
+        if (ret) {
+                ath10k_warn(ar, "failed to submit probe resp template command: %d\n",
+                            ret);
+                return ret;
+        }
+
+        return 0;
+}
+
 static void ath10k_control_beaconing(struct ath10k_vif *arvif,
                                      struct ieee80211_bss_conf *info)
 {
@@ -1046,28 +1202,85 @@ static void ath10k_control_ibss(struct ath10k_vif *arvif,
                             arvif->vdev_id, ret);
 }
 
-/*
- * Review this when mac80211 gains per-interface powersave support.
- */
+static int ath10k_mac_vif_recalc_ps_wake_threshold(struct ath10k_vif *arvif)
+{
+        struct ath10k *ar = arvif->ar;
+        u32 param;
+        u32 value;
+        int ret;
+
+        lockdep_assert_held(&arvif->ar->conf_mutex);
+
+        if (arvif->u.sta.uapsd)
+                value = WMI_STA_PS_TX_WAKE_THRESHOLD_NEVER;
+        else
+                value = WMI_STA_PS_TX_WAKE_THRESHOLD_ALWAYS;
+
+        param = WMI_STA_PS_PARAM_TX_WAKE_THRESHOLD;
+        ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id, param, value);
+        if (ret) {
+                ath10k_warn(ar, "failed to submit ps wake threshold %u on vdev %i: %d\n",
+                            value, arvif->vdev_id, ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+static int ath10k_mac_vif_recalc_ps_poll_count(struct ath10k_vif *arvif)
+{
+        struct ath10k *ar = arvif->ar;
+        u32 param;
+        u32 value;
+        int ret;
+
+        lockdep_assert_held(&arvif->ar->conf_mutex);
+
+        if (arvif->u.sta.uapsd)
+                value = WMI_STA_PS_PSPOLL_COUNT_UAPSD;
+        else
+                value = WMI_STA_PS_PSPOLL_COUNT_NO_MAX;
+
+        param = WMI_STA_PS_PARAM_PSPOLL_COUNT;
+        ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id,
+                                          param, value);
+        if (ret) {
+                ath10k_warn(ar, "failed to submit ps poll count %u on vdev %i: %d\n",
+                            value, arvif->vdev_id, ret);
+                return ret;
+        }
+
+        return 0;
+}
+
 static int ath10k_mac_vif_setup_ps(struct ath10k_vif *arvif)
 {
         struct ath10k *ar = arvif->ar;
+        struct ieee80211_vif *vif = arvif->vif;
         struct ieee80211_conf *conf = &ar->hw->conf;
         enum wmi_sta_powersave_param param;
         enum wmi_sta_ps_mode psmode;
         int ret;
+        int ps_timeout;
 
         lockdep_assert_held(&arvif->ar->conf_mutex);
 
         if (arvif->vif->type != NL80211_IFTYPE_STATION)
                 return 0;
 
-        if (conf->flags & IEEE80211_CONF_PS) {
+        if (vif->bss_conf.ps) {
                 psmode = WMI_STA_PS_MODE_ENABLED;
                 param = WMI_STA_PS_PARAM_INACTIVITY_TIME;
 
+                ps_timeout = conf->dynamic_ps_timeout;
+                if (ps_timeout == 0) {
+                        /* Firmware doesn't like 0 */
+                        ps_timeout = ieee80211_tu_to_usec(
+                                vif->bss_conf.beacon_int) / 1000;
+                }
+
                 ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id, param,
-                                                  conf->dynamic_ps_timeout);
+                                                  ps_timeout);
                 if (ret) {
                         ath10k_warn(ar, "failed to set inactivity time for vdev %d: %i\n",
                                     arvif->vdev_id, ret);
@@ -1090,6 +1303,38 @@ static int ath10k_mac_vif_setup_ps(struct ath10k_vif *arvif)
         return 0;
 }
 
+static int ath10k_mac_vif_disable_keepalive(struct ath10k_vif *arvif)
+{
+        struct ath10k *ar = arvif->ar;
+        struct wmi_sta_keepalive_arg arg = {};
+        int ret;
+
+        lockdep_assert_held(&arvif->ar->conf_mutex);
+
+        if (arvif->vdev_type != WMI_VDEV_TYPE_STA)
+                return 0;
+
+        if (!test_bit(WMI_SERVICE_STA_KEEP_ALIVE, ar->wmi.svc_map))
+                return 0;
+
+        /* Some firmware revisions have a bug and ignore the `enabled` field.
+         * Instead use the interval to disable the keepalive.
+         */
+        arg.vdev_id = arvif->vdev_id;
+        arg.enabled = 1;
+        arg.method = WMI_STA_KEEPALIVE_METHOD_NULL_FRAME;
+        arg.interval = WMI_STA_KEEPALIVE_INTERVAL_DISABLE;
+
+        ret = ath10k_wmi_sta_keepalive(ar, &arg);
+        if (ret) {
+                ath10k_warn(ar, "failed to submit keepalive on vdev %i: %d\n",
+                            arvif->vdev_id, ret);
+                return ret;
+        }
+
+        return 0;
+}
+
 /**********************/
 /* Station management */
 /**********************/
@@ -1358,6 +1603,10 @@ static void ath10k_peer_assoc_h_vht(struct ath10k *ar,
                 return;
 
         arg->peer_flags |= WMI_PEER_VHT;
+
+        if (ar->hw->conf.chandef.chan->band == IEEE80211_BAND_2GHZ)
+                arg->peer_flags |= WMI_PEER_VHT_2G;
+
         arg->peer_vht_caps = vht_cap->cap;
 
         ampdu_factor = (vht_cap->cap &
@@ -1409,9 +1658,22 @@ static void ath10k_peer_assoc_h_qos(struct ath10k *ar,
                 if (vif->bss_conf.qos)
                         arg->peer_flags |= WMI_PEER_QOS;
                 break;
+        case WMI_VDEV_TYPE_IBSS:
+                if (sta->wme)
+                        arg->peer_flags |= WMI_PEER_QOS;
+                break;
         default:
                 break;
         }
+
+        ath10k_dbg(ar, ATH10K_DBG_MAC, "mac peer %pM qos %d\n",
+                   sta->addr, !!(arg->peer_flags & WMI_PEER_QOS));
+}
+
+static bool ath10k_mac_sta_has_11g_rates(struct ieee80211_sta *sta)
+{
+        /* First 4 rates in ath10k_rates are CCK (11b) rates. */
+        return sta->supp_rates[IEEE80211_BAND_2GHZ] >> 4;
 }
 
 static void ath10k_peer_assoc_h_phymode(struct ath10k *ar,
@@ -1423,13 +1685,20 @@ static void ath10k_peer_assoc_h_phymode(struct ath10k *ar,
 
         switch (ar->hw->conf.chandef.chan->band) {
         case IEEE80211_BAND_2GHZ:
-                if (sta->ht_cap.ht_supported) {
+                if (sta->vht_cap.vht_supported) {
+                        if (sta->bandwidth == IEEE80211_STA_RX_BW_40)
+                                phymode = MODE_11AC_VHT40;
+                        else
+                                phymode = MODE_11AC_VHT20;
+                } else if (sta->ht_cap.ht_supported) {
                         if (sta->bandwidth == IEEE80211_STA_RX_BW_40)
                                 phymode = MODE_11NG_HT40;
                         else
                                 phymode = MODE_11NG_HT20;
-                } else {
+                } else if (ath10k_mac_sta_has_11g_rates(sta)) {
                         phymode = MODE_11G;
+                } else {
+                        phymode = MODE_11B;
                 }
 
                 break;
@@ -1603,7 +1872,8 @@ static void ath10k_bss_disassoc(struct ieee80211_hw *hw,
                 ath10k_warn(ar, "faield to down vdev %i: %d\n",
                             arvif->vdev_id, ret);
 
-        arvif->def_wep_key_idx = 0;
+        arvif->def_wep_key_idx = -1;
+
         arvif->is_up = false;
 }
 
@@ -1662,11 +1932,14 @@ static int ath10k_station_assoc(struct ath10k *ar,
                         }
                 }
 
-                ret = ath10k_install_peer_wep_keys(arvif, sta->addr);
-                if (ret) {
-                        ath10k_warn(ar, "failed to install peer wep keys for vdev %i: %d\n",
-                                    arvif->vdev_id, ret);
-                        return ret;
+                /* Plumb cached keys only for static WEP */
+                if (arvif->def_wep_key_idx != -1) {
+                        ret = ath10k_install_peer_wep_keys(arvif, sta->addr);
+                        if (ret) {
+                                ath10k_warn(ar, "failed to install peer wep keys for vdev %i: %d\n",
+                                            arvif->vdev_id, ret);
+                                return ret;
+                        }
                 }
         }
 
@@ -1931,75 +2204,13 @@ static void ath10k_tx_h_nwifi(struct ieee80211_hw *hw, struct sk_buff *skb)
          * used only for CQM purposes (e.g. hostapd station keepalive ping) so
          * it is safe to downgrade to NullFunc.
          */
+        hdr = (void *)skb->data;
         if (ieee80211_is_qos_nullfunc(hdr->frame_control)) {
                 hdr->frame_control &= ~__cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
                 cb->htt.tid = HTT_DATA_TX_EXT_TID_NON_QOS_MCAST_BCAST;
         }
 }
 
-static void ath10k_tx_wep_key_work(struct work_struct *work)
-{
-        struct ath10k_vif *arvif = container_of(work, struct ath10k_vif,
-                                                wep_key_work);
-        struct ath10k *ar = arvif->ar;
-        int ret, keyidx = arvif->def_wep_key_newidx;
-
-        mutex_lock(&arvif->ar->conf_mutex);
-
-        if (arvif->ar->state != ATH10K_STATE_ON)
-                goto unlock;
-
-        if (arvif->def_wep_key_idx == keyidx)
-                goto unlock;
-
-        ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d set keyidx %d\n",
-                   arvif->vdev_id, keyidx);
-
-        ret = ath10k_wmi_vdev_set_param(arvif->ar,
-                                        arvif->vdev_id,
-                                        arvif->ar->wmi.vdev_param->def_keyid,
-                                        keyidx);
-        if (ret) {
-                ath10k_warn(ar, "failed to update wep key index for vdev %d: %d\n",
-                            arvif->vdev_id,
-                            ret);
-                goto unlock;
-        }
-
-        arvif->def_wep_key_idx = keyidx;
-
-unlock:
-        mutex_unlock(&arvif->ar->conf_mutex);
-}
-
-static void ath10k_tx_h_update_wep_key(struct ieee80211_vif *vif,
-                                       struct ieee80211_key_conf *key,
-                                       struct sk_buff *skb)
-{
-        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
-        struct ath10k *ar = arvif->ar;
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-
-        if (!ieee80211_has_protected(hdr->frame_control))
-                return;
-
-        if (!key)
-                return;
-
-        if (key->cipher != WLAN_CIPHER_SUITE_WEP40 &&
-            key->cipher != WLAN_CIPHER_SUITE_WEP104)
-                return;
-
-        if (key->keyidx == arvif->def_wep_key_idx)
-                return;
-
-        /* FIXME: Most likely a few frames will be TXed with an old key. Simply
-         * queueing frames until key index is updated is not an option because
-         * sk_buff may need more processing to be done, e.g. offchannel */
-        arvif->def_wep_key_newidx = key->keyidx;
-        ieee80211_queue_work(ar->hw, &arvif->wep_key_work);
-}
-
 static void ath10k_tx_h_add_p2p_noa_ie(struct ath10k *ar,
                                        struct ieee80211_vif *vif,
                                        struct sk_buff *skb)
@@ -2151,7 +2362,7 @@ void ath10k_offchan_tx_work(struct work_struct *work)
 
                 ret = wait_for_completion_timeout(&ar->offchan_tx_completed,
                                                   3 * HZ);
-                if (ret <= 0)
+                if (ret == 0)
                         ath10k_warn(ar, "timed out waiting for offchannel skb %p\n",
                                     skb);
 
@@ -2213,6 +2424,7 @@ void __ath10k_scan_finish(struct ath10k *ar)
         case ATH10K_SCAN_RUNNING:
                 if (ar->scan.is_roc)
                         ieee80211_remain_on_channel_expired(ar->hw);
+                /* fall through */
         case ATH10K_SCAN_ABORTING:
                 if (!ar->scan.is_roc)
                         ieee80211_scan_completed(ar->hw,
@@ -2359,7 +2571,6 @@ static void ath10k_tx(struct ieee80211_hw *hw,
         struct ath10k *ar = hw->priv;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_vif *vif = info->control.vif;
-        struct ieee80211_key_conf *key = info->control.hw_key;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 
         /* We should disable CCK RATE due to P2P */
@@ -2373,7 +2584,6 @@ static void ath10k_tx(struct ieee80211_hw *hw,
         /* it makes no sense to process injected frames like that */
         if (vif && vif->type != NL80211_IFTYPE_MONITOR) {
                 ath10k_tx_h_nwifi(hw, skb);
-                ath10k_tx_h_update_wep_key(vif, key, skb);
                 ath10k_tx_h_add_p2p_noa_ie(ar, vif, skb);
                 ath10k_tx_h_seq_no(vif, skb);
         }
@@ -2871,6 +3081,8 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
         int bit;
         u32 vdev_param;
 
+        vif->driver_flags |= IEEE80211_VIF_SUPPORTS_UAPSD;
+
         mutex_lock(&ar->conf_mutex);
 
         memset(arvif, 0, sizeof(*arvif));
@@ -2878,7 +3090,6 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
         arvif->ar = ar;
         arvif->vif = vif;
 
-        INIT_WORK(&arvif->wep_key_work, ath10k_tx_wep_key_work);
         INIT_LIST_HEAD(&arvif->list);
 
         if (ar->free_vdev_map == 0) {
@@ -2894,10 +3105,11 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
         arvif->vdev_id = bit;
         arvif->vdev_subtype = WMI_VDEV_SUBTYPE_NONE;
 
-        if (ar->p2p)
-                arvif->vdev_subtype = WMI_VDEV_SUBTYPE_P2P_DEVICE;
-
         switch (vif->type) {
+        case NL80211_IFTYPE_P2P_DEVICE:
+                arvif->vdev_type = WMI_VDEV_TYPE_STA;
+                arvif->vdev_subtype = WMI_VDEV_SUBTYPE_P2P_DEVICE;
+                break;
         case NL80211_IFTYPE_UNSPECIFIED:
         case NL80211_IFTYPE_STATION:
                 arvif->vdev_type = WMI_VDEV_TYPE_STA;
@@ -2966,15 +3178,18 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
         ar->free_vdev_map &= ~(1LL << arvif->vdev_id);
         list_add(&arvif->list, &ar->arvifs);
 
-        vdev_param = ar->wmi.vdev_param->def_keyid;
-        ret = ath10k_wmi_vdev_set_param(ar, 0, vdev_param,
-                                        arvif->def_wep_key_idx);
+        /* It makes no sense to have firmware do keepalives. mac80211 already
+         * takes care of this with idle connection polling.
+         */
+        ret = ath10k_mac_vif_disable_keepalive(arvif);
         if (ret) {
-                ath10k_warn(ar, "failed to set vdev %i default key id: %d\n",
+                ath10k_warn(ar, "failed to disable keepalive on vdev %i: %d\n",
                             arvif->vdev_id, ret);
                 goto err_vdev_delete;
         }
 
+        arvif->def_wep_key_idx = -1;
+
         vdev_param = ar->wmi.vdev_param->tx_encap_type;
         ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
                                         ATH10K_HW_TXRX_NATIVE_WIFI);
@@ -3026,22 +3241,16 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
                         goto err_peer_delete;
                 }
 
-                param = WMI_STA_PS_PARAM_TX_WAKE_THRESHOLD;
-                value = WMI_STA_PS_TX_WAKE_THRESHOLD_ALWAYS;
-                ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id,
-                                                  param, value);
+                ret = ath10k_mac_vif_recalc_ps_wake_threshold(arvif);
                 if (ret) {
-                        ath10k_warn(ar, "failed to set vdev %i TX wake thresh: %d\n",
+                        ath10k_warn(ar, "failed to recalc ps wake threshold on vdev %i: %d\n",
                                     arvif->vdev_id, ret);
                         goto err_peer_delete;
                 }
 
-                param = WMI_STA_PS_PARAM_PSPOLL_COUNT;
-                value = WMI_STA_PS_PSPOLL_COUNT_NO_MAX;
-                ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id,
-                                                  param, value);
+                ret = ath10k_mac_vif_recalc_ps_poll_count(arvif);
                 if (ret) {
-                        ath10k_warn(ar, "failed to set vdev %i PSPOLL count: %d\n",
+                        ath10k_warn(ar, "failed to recalc ps poll count on vdev %i: %d\n",
                                     arvif->vdev_id, ret);
                         goto err_peer_delete;
                 }
@@ -3099,8 +3308,6 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw,
         struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
         int ret;
 
-        cancel_work_sync(&arvif->wep_key_work);
-
         mutex_lock(&ar->conf_mutex);
 
         spin_lock_bh(&ar->data_lock);
@@ -3211,9 +3418,21 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                 if (ret)
                         ath10k_warn(ar, "failed to set beacon mode for vdev %d: %i\n",
                                     arvif->vdev_id, ret);
+
+                ret = ath10k_mac_setup_bcn_tmpl(arvif);
+                if (ret)
+                        ath10k_warn(ar, "failed to update beacon template: %d\n",
+                                    ret);
         }
 
-        if (changed & BSS_CHANGED_BEACON_INFO) {
+        if (changed & BSS_CHANGED_AP_PROBE_RESP) {
+                ret = ath10k_mac_setup_prb_tmpl(arvif);
+                if (ret)
+                        ath10k_warn(ar, "failed to setup probe resp template on vdev %i: %d\n",
+                                    arvif->vdev_id, ret);
+        }
+
+        if (changed & (BSS_CHANGED_BEACON_INFO | BSS_CHANGED_BEACON)) {
                 arvif->dtim_period = info->dtim_period;
 
                 ath10k_dbg(ar, ATH10K_DBG_MAC,
@@ -3314,6 +3533,13 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                         ath10k_warn(ar, "failed to recalc tx power: %d\n", ret);
         }
 
+        if (changed & BSS_CHANGED_PS) {
+                ret = ath10k_mac_vif_setup_ps(arvif);
+                if (ret)
+                        ath10k_warn(ar, "failed to setup ps on vdev %i: %d\n",
+                                    arvif->vdev_id, ret);
+        }
+
         mutex_unlock(&ar->conf_mutex);
 }
 
@@ -3453,6 +3679,7 @@ static int ath10k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         const u8 *peer_addr;
         bool is_wep = key->cipher == WLAN_CIPHER_SUITE_WEP40 ||
                       key->cipher == WLAN_CIPHER_SUITE_WEP104;
+        bool def_idx = false;
         int ret = 0;
 
         if (key->keyidx > WMI_MAX_KEY_INDEX)
@@ -3498,7 +3725,14 @@ static int ath10k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                         ath10k_clear_vdev_key(arvif, key);
         }
 
-        ret = ath10k_install_key(arvif, key, cmd, peer_addr);
+        /* set TX_USAGE flag for all the keys incase of dot1x-WEP. For
+         * static WEP, do not set this flag for the keys whose key id
+         * is  greater than default key id.
+         */
+        if (arvif->def_wep_key_idx == -1)
+                def_idx = true;
+
+        ret = ath10k_install_key(arvif, key, cmd, peer_addr, def_idx);
         if (ret) {
                 ath10k_warn(ar, "failed to install key for vdev %i peer %pM: %d\n",
                             arvif->vdev_id, peer_addr, ret);
@@ -3523,6 +3757,39 @@ exit:
         return ret;
 }
 
+static void ath10k_set_default_unicast_key(struct ieee80211_hw *hw,
+                                           struct ieee80211_vif *vif,
+                                           int keyidx)
+{
+        struct ath10k *ar = hw->priv;
+        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
+        int ret;
+
+        mutex_lock(&arvif->ar->conf_mutex);
+
+        if (arvif->ar->state != ATH10K_STATE_ON)
+                goto unlock;
+
+        ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d set keyidx %d\n",
+                   arvif->vdev_id, keyidx);
+
+        ret = ath10k_wmi_vdev_set_param(arvif->ar,
+                                        arvif->vdev_id,
+                                        arvif->ar->wmi.vdev_param->def_keyid,
+                                        keyidx);
+
+        if (ret) {
+                ath10k_warn(ar, "failed to update wep key index for vdev %d: %d\n",
+                            arvif->vdev_id,
+                            ret);
+                goto unlock;
+        }
+
+        arvif->def_wep_key_idx = keyidx;
+unlock:
+        mutex_unlock(&arvif->ar->conf_mutex);
+}
+
 static void ath10k_sta_rc_update_wk(struct work_struct *wk)
 {
         struct ath10k *ar;
@@ -3583,8 +3850,9 @@ static void ath10k_sta_rc_update_wk(struct work_struct *wk)
                                     sta->addr, smps, err);
         }
 
-        if (changed & IEEE80211_RC_SUPP_RATES_CHANGED) {
-                ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM supp rates\n",
+        if (changed & IEEE80211_RC_SUPP_RATES_CHANGED ||
+            changed & IEEE80211_RC_NSS_CHANGED) {
+                ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM supp rates/nss\n",
                            sta->addr);
 
                 err = ath10k_station_assoc(ar, arvif->vif, sta, true);
@@ -3757,6 +4025,8 @@ static int ath10k_conf_tx_uapsd(struct ath10k *ar, struct ieee80211_vif *vif,
                                 u16 ac, bool enable)
 {
         struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
+        struct wmi_sta_uapsd_auto_trig_arg arg = {};
+        u32 prio = 0, acc = 0;
         u32 value = 0;
         int ret = 0;
 
@@ -3769,18 +4039,26 @@ static int ath10k_conf_tx_uapsd(struct ath10k *ar, struct ieee80211_vif *vif,
         case IEEE80211_AC_VO:
                 value = WMI_STA_PS_UAPSD_AC3_DELIVERY_EN |
                         WMI_STA_PS_UAPSD_AC3_TRIGGER_EN;
+                prio = 7;
+                acc = 3;
                 break;
         case IEEE80211_AC_VI:
                 value = WMI_STA_PS_UAPSD_AC2_DELIVERY_EN |
                         WMI_STA_PS_UAPSD_AC2_TRIGGER_EN;
+                prio = 5;
+                acc = 2;
                 break;
         case IEEE80211_AC_BE:
                 value = WMI_STA_PS_UAPSD_AC1_DELIVERY_EN |
                         WMI_STA_PS_UAPSD_AC1_TRIGGER_EN;
+                prio = 2;
+                acc = 1;
                 break;
         case IEEE80211_AC_BK:
                 value = WMI_STA_PS_UAPSD_AC0_DELIVERY_EN |
                         WMI_STA_PS_UAPSD_AC0_TRIGGER_EN;
+                prio = 0;
+                acc = 0;
                 break;
         }
 
@@ -3808,6 +4086,43 @@ static int ath10k_conf_tx_uapsd(struct ath10k *ar, struct ieee80211_vif *vif,
         if (ret)
                 ath10k_warn(ar, "failed to set rx wake param: %d\n", ret);
 
+        ret = ath10k_mac_vif_recalc_ps_wake_threshold(arvif);
+        if (ret) {
+                ath10k_warn(ar, "failed to recalc ps wake threshold on vdev %i: %d\n",
+                            arvif->vdev_id, ret);
+                return ret;
+        }
+
+        ret = ath10k_mac_vif_recalc_ps_poll_count(arvif);
+        if (ret) {
+                ath10k_warn(ar, "failed to recalc ps poll count on vdev %i: %d\n",
+                            arvif->vdev_id, ret);
+                return ret;
+        }
+
+        if (test_bit(WMI_SERVICE_STA_UAPSD_BASIC_AUTO_TRIG, ar->wmi.svc_map) ||
+            test_bit(WMI_SERVICE_STA_UAPSD_VAR_AUTO_TRIG, ar->wmi.svc_map)) {
+                /* Only userspace can make an educated decision when to send
+                 * trigger frame. The following effectively disables u-UAPSD
+                 * autotrigger in firmware (which is enabled by default
+                 * provided the autotrigger service is available).
+                 */
+
+                arg.wmm_ac = acc;
+                arg.user_priority = prio;
+                arg.service_interval = 0;
+                arg.suspend_interval = WMI_STA_UAPSD_MAX_INTERVAL_MSEC;
+                arg.delay_interval = WMI_STA_UAPSD_MAX_INTERVAL_MSEC;
+
+                ret = ath10k_wmi_vdev_sta_uapsd(ar, arvif->vdev_id,
+                                                arvif->bssid, &arg, 1);
+                if (ret) {
+                        ath10k_warn(ar, "failed to set uapsd auto trigger %d\n",
+                                    ret);
+                        return ret;
+                }
+        }
+
 exit:
         return ret;
 }
@@ -3817,6 +4132,7 @@ static int ath10k_conf_tx(struct ieee80211_hw *hw,
                           const struct ieee80211_tx_queue_params *params)
 {
         struct ath10k *ar = hw->priv;
+        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
         struct wmi_wmm_params_arg *p = NULL;
         int ret;
 
@@ -3824,16 +4140,16 @@ static int ath10k_conf_tx(struct ieee80211_hw *hw,
 
         switch (ac) {
         case IEEE80211_AC_VO:
-                p = &ar->wmm_params.ac_vo;
+                p = &arvif->wmm_params.ac_vo;
                 break;
         case IEEE80211_AC_VI:
-                p = &ar->wmm_params.ac_vi;
+                p = &arvif->wmm_params.ac_vi;
                 break;
         case IEEE80211_AC_BE:
-                p = &ar->wmm_params.ac_be;
+                p = &arvif->wmm_params.ac_be;
                 break;
         case IEEE80211_AC_BK:
-                p = &ar->wmm_params.ac_bk;
+                p = &arvif->wmm_params.ac_bk;
                 break;
         }
 
@@ -3853,11 +4169,23 @@ static int ath10k_conf_tx(struct ieee80211_hw *hw,
          */
         p->txop = params->txop * 32;
 
-        /* FIXME: FW accepts wmm params per hw, not per vif */
-        ret = ath10k_wmi_pdev_set_wmm_params(ar, &ar->wmm_params);
-        if (ret) {
-                ath10k_warn(ar, "failed to set wmm params: %d\n", ret);
-                goto exit;
+        if (ar->wmi.ops->gen_vdev_wmm_conf) {
+                ret = ath10k_wmi_vdev_wmm_conf(ar, arvif->vdev_id,
+                                               &arvif->wmm_params);
+                if (ret) {
+                        ath10k_warn(ar, "failed to set vdev wmm params on vdev %i: %d\n",
+                                    arvif->vdev_id, ret);
+                        goto exit;
+                }
+        } else {
+                /* This won't work well with multi-interface cases but it's
+                 * better than nothing.
+                 */
+                ret = ath10k_wmi_pdev_set_wmm_params(ar, &arvif->wmm_params);
+                if (ret) {
+                        ath10k_warn(ar, "failed to set wmm params: %d\n", ret);
+                        goto exit;
+                }
         }
 
         ret = ath10k_conf_tx_uapsd(ar, vif, ac, params->uapsd);
@@ -3989,29 +4317,6 @@ static int ath10k_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
         return ret;
 }
 
-static int ath10k_set_frag_threshold(struct ieee80211_hw *hw, u32 value)
-{
-        struct ath10k *ar = hw->priv;
-        struct ath10k_vif *arvif;
-        int ret = 0;
-
-        mutex_lock(&ar->conf_mutex);
-        list_for_each_entry(arvif, &ar->arvifs, list) {
-                ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d fragmentation threshold %d\n",
-                           arvif->vdev_id, value);
-
-                ret = ath10k_mac_set_frag(arvif, value);
-                if (ret) {
-                        ath10k_warn(ar, "failed to set fragmentation threshold for vdev %d: %d\n",
-                                    arvif->vdev_id, ret);
-                        break;
-                }
-        }
-        mutex_unlock(&ar->conf_mutex);
-
-        return ret;
-}
-
 static void ath10k_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                          u32 queues, bool drop)
 {
@@ -4650,12 +4955,12 @@ static const struct ieee80211_ops ath10k_ops = {
         .hw_scan                        = ath10k_hw_scan,
         .cancel_hw_scan                 = ath10k_cancel_hw_scan,
         .set_key                        = ath10k_set_key,
+        .set_default_unicast_key        = ath10k_set_default_unicast_key,
         .sta_state                      = ath10k_sta_state,
         .conf_tx                        = ath10k_conf_tx,
         .remain_on_channel              = ath10k_remain_on_channel,
         .cancel_remain_on_channel       = ath10k_cancel_remain_on_channel,
         .set_rts_threshold              = ath10k_set_rts_threshold,
-        .set_frag_threshold             = ath10k_set_frag_threshold,
         .flush                          = ath10k_flush,
         .tx_last_beacon                 = ath10k_tx_last_beacon,
         .set_antenna                    = ath10k_set_antenna,
@@ -4676,6 +4981,9 @@ static const struct ieee80211_ops ath10k_ops = {
         .suspend                        = ath10k_suspend,
         .resume                         = ath10k_resume,
 #endif
+#ifdef CONFIG_MAC80211_DEBUGFS
+        .sta_add_debugfs                = ath10k_sta_add_debugfs,
+#endif
 };
 
 #define RATETAB_ENT(_rate, _rateid, _flags) { \
@@ -4746,6 +5054,9 @@ static const struct ieee80211_channel ath10k_5ghz_channels[] = {
         CHAN5G(165, 5825, 0),
 };
 
+/* Note: Be careful if you re-order these. There is code which depends on this
+ * ordering.
+ */
 static struct ieee80211_rate ath10k_rates[] = {
         /* CCK */
         RATETAB_ENT(10,  0x82, 0),
@@ -4799,6 +5110,10 @@ static const struct ieee80211_iface_limit ath10k_if_limits[] = {
         .types  = BIT(NL80211_IFTYPE_P2P_GO)
         },
         {
+        .max    = 1,
+        .types  = BIT(NL80211_IFTYPE_P2P_DEVICE)
+        },
+        {
         .max    = 7,
         .types  = BIT(NL80211_IFTYPE_AP)
         },
@@ -4956,6 +5271,13 @@ struct ath10k_vif *ath10k_get_arvif(struct ath10k *ar, u32 vdev_id)
 
 int ath10k_mac_register(struct ath10k *ar)
 {
+        static const u32 cipher_suites[] = {
+                WLAN_CIPHER_SUITE_WEP40,
+                WLAN_CIPHER_SUITE_WEP104,
+                WLAN_CIPHER_SUITE_TKIP,
+                WLAN_CIPHER_SUITE_CCMP,
+                WLAN_CIPHER_SUITE_AES_CMAC,
+        };
         struct ieee80211_supported_band *band;
         struct ieee80211_sta_vht_cap vht_cap;
         struct ieee80211_sta_ht_cap ht_cap;
@@ -4985,7 +5307,8 @@ int ath10k_mac_register(struct ath10k *ar)
                 band->bitrates = ath10k_g_rates;
                 band->ht_cap = ht_cap;
 
-                /* vht is not supported in 2.4 GHz */
+                /* Enable the VHT support at 2.4 GHz */
+                band->vht_cap = vht_cap;
 
                 ar->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = band;
         }
@@ -5018,18 +5341,19 @@ int ath10k_mac_register(struct ath10k *ar)
 
         if (!test_bit(ATH10K_FW_FEATURE_NO_P2P, ar->fw_features))
                 ar->hw->wiphy->interface_modes |=
+                        BIT(NL80211_IFTYPE_P2P_DEVICE) |
                         BIT(NL80211_IFTYPE_P2P_CLIENT) |
                         BIT(NL80211_IFTYPE_P2P_GO);
 
         ar->hw->flags = IEEE80211_HW_SIGNAL_DBM |
                         IEEE80211_HW_SUPPORTS_PS |
                         IEEE80211_HW_SUPPORTS_DYNAMIC_PS |
-                        IEEE80211_HW_SUPPORTS_UAPSD |
                         IEEE80211_HW_MFP_CAPABLE |
                         IEEE80211_HW_REPORTS_TX_ACK_STATUS |
                         IEEE80211_HW_HAS_RATE_CONTROL |
                         IEEE80211_HW_AP_LINK_PS |
-                        IEEE80211_HW_SPECTRUM_MGMT;
+                        IEEE80211_HW_SPECTRUM_MGMT |
+                        IEEE80211_HW_SW_CRYPTO_CONTROL;
 
         ar->hw->wiphy->features |= NL80211_FEATURE_STATIC_SMPS;
 
@@ -5049,6 +5373,19 @@ int ath10k_mac_register(struct ath10k *ar)
 
         ar->hw->max_listen_interval = ATH10K_MAX_HW_LISTEN_INTERVAL;
 
+        if (test_bit(WMI_SERVICE_BEACON_OFFLOAD, ar->wmi.svc_map)) {
+                ar->hw->wiphy->flags |= WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD;
+
+                /* Firmware delivers WPS/P2P Probe Requests frames to driver so
+                 * that userspace (e.g. wpa_supplicant/hostapd) can generate
+                 * correct Probe Responses. This is more of a hack advert..
+                 */
+                ar->hw->wiphy->probe_resp_offload |=
+                        NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS |
+                        NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS2 |
+                        NL80211_PROBE_RESP_OFFLOAD_SUPPORT_P2P;
+        }
+
         ar->hw->wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
         ar->hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
         ar->hw->wiphy->max_remain_on_channel_duration = 5000;
@@ -5062,16 +5399,26 @@ int ath10k_mac_register(struct ath10k *ar)
          */
         ar->hw->queues = 4;
 
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                ar->hw->wiphy->iface_combinations = ath10k_10x_if_comb;
-                ar->hw->wiphy->n_iface_combinations =
-                        ARRAY_SIZE(ath10k_10x_if_comb);
-        } else {
+        switch (ar->wmi.op_version) {
+        case ATH10K_FW_WMI_OP_VERSION_MAIN:
+        case ATH10K_FW_WMI_OP_VERSION_TLV:
                 ar->hw->wiphy->iface_combinations = ath10k_if_comb;
                 ar->hw->wiphy->n_iface_combinations =
                         ARRAY_SIZE(ath10k_if_comb);
-
                 ar->hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC);
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_10_1:
+        case ATH10K_FW_WMI_OP_VERSION_10_2:
+        case ATH10K_FW_WMI_OP_VERSION_10_2_4:
+                ar->hw->wiphy->iface_combinations = ath10k_10x_if_comb;
+                ar->hw->wiphy->n_iface_combinations =
+                        ARRAY_SIZE(ath10k_10x_if_comb);
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_UNSET:
+        case ATH10K_FW_WMI_OP_VERSION_MAX:
+                WARN_ON(1);
+                ret = -EINVAL;
+                goto err_free;
         }
 
         ar->hw->netdev_features = NETIF_F_HW_CSUM;
@@ -5093,6 +5440,9 @@ int ath10k_mac_register(struct ath10k *ar)
                 goto err_free;
         }
 
+        ar->hw->wiphy->cipher_suites = cipher_suites;
+        ar->hw->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
+
         ret = ieee80211_register_hw(ar->hw);
         if (ret) {
                 ath10k_err(ar, "failed to register ieee80211: %d\n", ret);
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index 7abb8367119a..e6972b09333e 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -58,12 +58,27 @@ MODULE_PARM_DESC(reset_mode, "0: auto, 1: warm only (default: 0)");
 #define ATH10K_PCI_NUM_WARM_RESET_ATTEMPTS 3
 
 #define QCA988X_2_0_DEVICE_ID   (0x003c)
+#define QCA6174_2_1_DEVICE_ID   (0x003e)
 
 static const struct pci_device_id ath10k_pci_id_table[] = {
         { PCI_VDEVICE(ATHEROS, QCA988X_2_0_DEVICE_ID) }, /* PCI-E QCA988X V2 */
+        { PCI_VDEVICE(ATHEROS, QCA6174_2_1_DEVICE_ID) }, /* PCI-E QCA6174 V2.1 */
         {0}
 };
 
+static const struct ath10k_pci_supp_chip ath10k_pci_supp_chips[] = {
+        /* QCA988X pre 2.0 chips are not supported because they need some nasty
+         * hacks. ath10k doesn't have them and these devices crash horribly
+         * because of that.
+         */
+        { QCA988X_2_0_DEVICE_ID, QCA988X_HW_2_0_CHIP_ID_REV },
+        { QCA6174_2_1_DEVICE_ID, QCA6174_HW_2_1_CHIP_ID_REV },
+        { QCA6174_2_1_DEVICE_ID, QCA6174_HW_2_2_CHIP_ID_REV },
+        { QCA6174_2_1_DEVICE_ID, QCA6174_HW_3_0_CHIP_ID_REV },
+        { QCA6174_2_1_DEVICE_ID, QCA6174_HW_3_1_CHIP_ID_REV },
+        { QCA6174_2_1_DEVICE_ID, QCA6174_HW_3_2_CHIP_ID_REV },
+};
+
 static void ath10k_pci_buffer_cleanup(struct ath10k *ar);
 static int ath10k_pci_cold_reset(struct ath10k *ar);
 static int ath10k_pci_warm_reset(struct ath10k *ar);
@@ -395,7 +410,7 @@ static int __ath10k_pci_rx_post_buf(struct ath10k_pci_pipe *pipe)
                 return -EIO;
         }
 
-        ATH10K_SKB_CB(skb)->paddr = paddr;
+        ATH10K_SKB_RXCB(skb)->paddr = paddr;
 
         ret = __ath10k_ce_rx_post_buf(ce_pipe, skb, paddr);
         if (ret) {
@@ -864,7 +879,7 @@ static void ath10k_pci_ce_recv_data(struct ath10k_ce_pipe *ce_state)
                                              &flags) == 0) {
                 skb = transfer_context;
                 max_nbytes = skb->len + skb_tailroom(skb);
-                dma_unmap_single(ar->dev, ATH10K_SKB_CB(skb)->paddr,
+                dma_unmap_single(ar->dev, ATH10K_SKB_RXCB(skb)->paddr,
                                  max_nbytes, DMA_FROM_DEVICE);
 
                 if (unlikely(max_nbytes < nbytes)) {
@@ -1230,7 +1245,7 @@ static void ath10k_pci_rx_pipe_cleanup(struct ath10k_pci_pipe *pci_pipe)
 
                 ce_ring->per_transfer_context[i] = NULL;
 
-                dma_unmap_single(ar->dev, ATH10K_SKB_CB(skb)->paddr,
+                dma_unmap_single(ar->dev, ATH10K_SKB_RXCB(skb)->paddr,
                                  skb->len + skb_tailroom(skb),
                                  DMA_FROM_DEVICE);
                 dev_kfree_skb_any(skb);
@@ -1498,6 +1513,35 @@ static int ath10k_pci_wake_target_cpu(struct ath10k *ar)
         return 0;
 }
 
+static int ath10k_pci_get_num_banks(struct ath10k *ar)
+{
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+
+        switch (ar_pci->pdev->device) {
+        case QCA988X_2_0_DEVICE_ID:
+                return 1;
+        case QCA6174_2_1_DEVICE_ID:
+                switch (MS(ar->chip_id, SOC_CHIP_ID_REV)) {
+                case QCA6174_HW_1_0_CHIP_ID_REV:
+                case QCA6174_HW_1_1_CHIP_ID_REV:
+                        return 3;
+                case QCA6174_HW_1_3_CHIP_ID_REV:
+                        return 2;
+                case QCA6174_HW_2_1_CHIP_ID_REV:
+                case QCA6174_HW_2_2_CHIP_ID_REV:
+                        return 6;
+                case QCA6174_HW_3_0_CHIP_ID_REV:
+                case QCA6174_HW_3_1_CHIP_ID_REV:
+                case QCA6174_HW_3_2_CHIP_ID_REV:
+                        return 9;
+                }
+                break;
+        }
+
+        ath10k_warn(ar, "unknown number of banks, assuming 1\n");
+        return 1;
+}
+
 static int ath10k_pci_init_config(struct ath10k *ar)
 {
         u32 interconnect_targ_addr;
@@ -1608,7 +1652,8 @@ static int ath10k_pci_init_config(struct ath10k *ar)
         /* first bank is switched to IRAM */
         ealloc_value |= ((HI_EARLY_ALLOC_MAGIC << HI_EARLY_ALLOC_MAGIC_SHIFT) &
                          HI_EARLY_ALLOC_MAGIC_MASK);
-        ealloc_value |= ((1 << HI_EARLY_ALLOC_IRAM_BANKS_SHIFT) &
+        ealloc_value |= ((ath10k_pci_get_num_banks(ar) <<
+                          HI_EARLY_ALLOC_IRAM_BANKS_SHIFT) &
                          HI_EARLY_ALLOC_IRAM_BANKS_MASK);
 
         ret = ath10k_pci_diag_write32(ar, ealloc_targ_addr, ealloc_value);
@@ -1804,12 +1849,12 @@ static int ath10k_pci_warm_reset(struct ath10k *ar)
         return 0;
 }
 
-static int ath10k_pci_chip_reset(struct ath10k *ar)
+static int ath10k_pci_qca988x_chip_reset(struct ath10k *ar)
 {
         int i, ret;
         u32 val;
 
-        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot chip reset\n");
+        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot 988x chip reset\n");
 
         /* Some hardware revisions (e.g. CUS223v2) has issues with cold reset.
          * It is thus preferred to use warm reset which is safer but may not be
@@ -1873,11 +1918,53 @@ static int ath10k_pci_chip_reset(struct ath10k *ar)
                 return ret;
         }
 
-        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot chip reset complete (cold)\n");
+        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot qca988x chip reset complete (cold)\n");
+
+        return 0;
+}
+
+static int ath10k_pci_qca6174_chip_reset(struct ath10k *ar)
+{
+        int ret;
+
+        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot qca6174 chip reset\n");
+
+        /* FIXME: QCA6174 requires cold + warm reset to work. */
+
+        ret = ath10k_pci_cold_reset(ar);
+        if (ret) {
+                ath10k_warn(ar, "failed to cold reset: %d\n", ret);
+                return ret;
+        }
+
+        ret = ath10k_pci_wait_for_target_init(ar);
+        if (ret) {
+                ath10k_warn(ar, "failed to wait for target after cold reset: %d\n",
+                                ret);
+                return ret;
+        }
+
+        ret = ath10k_pci_warm_reset(ar);
+        if (ret) {
+                ath10k_warn(ar, "failed to warm reset: %d\n", ret);
+                return ret;
+        }
+
+        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot qca6174 chip reset complete (cold)\n");
 
         return 0;
 }
 
+static int ath10k_pci_chip_reset(struct ath10k *ar)
+{
+        if (QCA_REV_988X(ar))
+                return ath10k_pci_qca988x_chip_reset(ar);
+        else if (QCA_REV_6174(ar))
+                return ath10k_pci_qca6174_chip_reset(ar);
+        else
+                return -ENOTSUPP;
+}
+
 static int ath10k_pci_hif_power_up(struct ath10k *ar)
 {
         int ret;
@@ -1902,6 +1989,12 @@ static int ath10k_pci_hif_power_up(struct ath10k *ar)
          */
         ret = ath10k_pci_chip_reset(ar);
         if (ret) {
+                if (ath10k_pci_has_fw_crashed(ar)) {
+                        ath10k_warn(ar, "firmware crashed during chip reset\n");
+                        ath10k_pci_fw_crashed_clear(ar);
+                        ath10k_pci_fw_crashed_dump(ar);
+                }
+
                 ath10k_err(ar, "failed to reset chip: %d\n", ret);
                 goto err_sleep;
         }
@@ -2033,6 +2126,7 @@ static void ath10k_msi_err_tasklet(unsigned long data)
                 return;
         }
 
+        ath10k_pci_irq_disable(ar);
         ath10k_pci_fw_crashed_clear(ar);
         ath10k_pci_fw_crashed_dump(ar);
 }
@@ -2102,6 +2196,7 @@ static void ath10k_pci_tasklet(unsigned long data)
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
 
         if (ath10k_pci_has_fw_crashed(ar)) {
+                ath10k_pci_irq_disable(ar);
                 ath10k_pci_fw_crashed_clear(ar);
                 ath10k_pci_fw_crashed_dump(ar);
                 return;
@@ -2344,8 +2439,6 @@ static int ath10k_pci_wait_for_target_init(struct ath10k *ar)
 
         if (val & FW_IND_EVENT_PENDING) {
                 ath10k_warn(ar, "device has crashed during init\n");
-                ath10k_pci_fw_crashed_clear(ar);
-                ath10k_pci_fw_crashed_dump(ar);
                 return -ECOMM;
         }
 
@@ -2476,17 +2569,46 @@ static void ath10k_pci_release(struct ath10k *ar)
         pci_disable_device(pdev);
 }
 
+static bool ath10k_pci_chip_is_supported(u32 dev_id, u32 chip_id)
+{
+        const struct ath10k_pci_supp_chip *supp_chip;
+        int i;
+        u32 rev_id = MS(chip_id, SOC_CHIP_ID_REV);
+
+        for (i = 0; i < ARRAY_SIZE(ath10k_pci_supp_chips); i++) {
+                supp_chip = &ath10k_pci_supp_chips[i];
+
+                if (supp_chip->dev_id == dev_id &&
+                    supp_chip->rev_id == rev_id)
+                        return true;
+        }
+
+        return false;
+}
+
 static int ath10k_pci_probe(struct pci_dev *pdev,
                             const struct pci_device_id *pci_dev)
 {
         int ret = 0;
         struct ath10k *ar;
         struct ath10k_pci *ar_pci;
+        enum ath10k_hw_rev hw_rev;
         u32 chip_id;
 
-        ar = ath10k_core_create(sizeof(*ar_pci), &pdev->dev,
-                                ATH10K_BUS_PCI,
-                                &ath10k_pci_hif_ops);
+        switch (pci_dev->device) {
+        case QCA988X_2_0_DEVICE_ID:
+                hw_rev = ATH10K_HW_QCA988X;
+                break;
+        case QCA6174_2_1_DEVICE_ID:
+                hw_rev = ATH10K_HW_QCA6174;
+                break;
+        default:
+                WARN_ON(1);
+                return -ENOTSUPP;
+        }
+
+        ar = ath10k_core_create(sizeof(*ar_pci), &pdev->dev, ATH10K_BUS_PCI,
+                                hw_rev, &ath10k_pci_hif_ops);
         if (!ar) {
                 dev_err(&pdev->dev, "failed to allocate core\n");
                 return -ENOMEM;
@@ -2515,12 +2637,6 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
                 goto err_release;
         }
 
-        chip_id = ath10k_pci_soc_read32(ar, SOC_CHIP_ID_ADDRESS);
-        if (chip_id == 0xffffffff) {
-                ath10k_err(ar, "failed to get chip id\n");
-                goto err_sleep;
-        }
-
         ret = ath10k_pci_alloc_pipes(ar);
         if (ret) {
                 ath10k_err(ar, "failed to allocate copy engine pipes: %d\n",
@@ -2547,6 +2663,24 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
                 goto err_deinit_irq;
         }
 
+        ret = ath10k_pci_chip_reset(ar);
+        if (ret) {
+                ath10k_err(ar, "failed to reset chip: %d\n", ret);
+                goto err_free_irq;
+        }
+
+        chip_id = ath10k_pci_soc_read32(ar, SOC_CHIP_ID_ADDRESS);
+        if (chip_id == 0xffffffff) {
+                ath10k_err(ar, "failed to get chip id\n");
+                goto err_free_irq;
+        }
+
+        if (!ath10k_pci_chip_is_supported(pdev->device, chip_id)) {
+                ath10k_err(ar, "device %04x with chip_id %08x isn't supported\n",
+                           pdev->device, chip_id);
+                goto err_sleep;
+        }
+
         ath10k_pci_sleep(ar);
 
         ret = ath10k_core_register(ar, chip_id);
diff --git a/drivers/net/wireless/ath/ath10k/pci.h b/drivers/net/wireless/ath/ath10k/pci.h
index cf36511c7f4d..bddf54320160 100644
--- a/drivers/net/wireless/ath/ath10k/pci.h
+++ b/drivers/net/wireless/ath/ath10k/pci.h
@@ -152,6 +152,11 @@ struct ath10k_pci_pipe {
         struct tasklet_struct intr;
 };
 
+struct ath10k_pci_supp_chip {
+        u32 dev_id;
+        u32 rev_id;
+};
+
 struct ath10k_pci {
         struct pci_dev *pdev;
         struct device *dev;
@@ -189,7 +194,7 @@ static inline struct ath10k_pci *ath10k_pci_priv(struct ath10k *ar)
 
 #define ATH10K_PCI_RX_POST_RETRY_MS 50
 #define ATH_PCI_RESET_WAIT_MAX 10 /* ms */
-#define PCIE_WAKE_TIMEOUT 5000  /* 5ms */
+#define PCIE_WAKE_TIMEOUT 10000 /* 10ms */
 
 #define BAR_NUM 0
 
diff --git a/drivers/net/wireless/ath/ath10k/rx_desc.h b/drivers/net/wireless/ath/ath10k/rx_desc.h
index e1ffdd57a18c..e9cc7787bf5f 100644
--- a/drivers/net/wireless/ath/ath10k/rx_desc.h
+++ b/drivers/net/wireless/ath/ath10k/rx_desc.h
@@ -850,7 +850,7 @@ struct rx_ppdu_start {
 
 #define RX_PPDU_END_INFO1_PPDU_DONE (1 << 15)
 
-struct rx_ppdu_end {
+struct rx_ppdu_end_common {
         __le32 evm_p0;
         __le32 evm_p1;
         __le32 evm_p2;
@@ -873,10 +873,33 @@ struct rx_ppdu_end {
         u8 phy_err_code;
         __le16 flags; /* %RX_PPDU_END_FLAGS_ */
         __le32 info0; /* %RX_PPDU_END_INFO0_ */
+} __packed;
+
+struct rx_ppdu_end_qca988x {
         __le16 bb_length;
         __le16 info1; /* %RX_PPDU_END_INFO1_ */
 } __packed;
 
+#define RX_PPDU_END_RTT_CORRELATION_VALUE_MASK 0x00ffffff
+#define RX_PPDU_END_RTT_CORRELATION_VALUE_LSB  0
+#define RX_PPDU_END_RTT_UNUSED_MASK            0x7f000000
+#define RX_PPDU_END_RTT_UNUSED_LSB             24
+#define RX_PPDU_END_RTT_NORMAL_MODE            BIT(31)
+
+struct rx_ppdu_end_qca6174 {
+        __le32 rtt; /* %RX_PPDU_END_RTT_ */
+        __le16 bb_length;
+        __le16 info1; /* %RX_PPDU_END_INFO1_ */
+} __packed;
+
+struct rx_ppdu_end {
+        struct rx_ppdu_end_common common;
+        union {
+                struct rx_ppdu_end_qca988x qca988x;
+                struct rx_ppdu_end_qca6174 qca6174;
+        } __packed;
+} __packed;
+
 /*
  * evm_p0
  *              EVM for pilot 0.  Contain EVM for streams: 0, 1, 2 and 3.
diff --git a/drivers/net/wireless/ath/ath10k/spectral.c b/drivers/net/wireless/ath/ath10k/spectral.c
index 63ce61fcdac8..d22addf6118b 100644
--- a/drivers/net/wireless/ath/ath10k/spectral.c
+++ b/drivers/net/wireless/ath/ath10k/spectral.c
@@ -17,6 +17,7 @@
 #include <linux/relay.h>
 #include "core.h"
 #include "debug.h"
+#include "wmi-ops.h"
 
 static void send_fft_sample(struct ath10k *ar,
                             const struct fft_sample_tlv *fft_sample_tlv)
diff --git a/drivers/net/wireless/ath/ath10k/targaddrs.h b/drivers/net/wireless/ath/ath10k/targaddrs.h
index 9d0ae30f9ff1..a417aae52623 100644
--- a/drivers/net/wireless/ath/ath10k/targaddrs.h
+++ b/drivers/net/wireless/ath/ath10k/targaddrs.h
@@ -18,6 +18,8 @@
 #ifndef __TARGADDRS_H__
 #define __TARGADDRS_H__
 
+#include "hw.h"
+
 /*
  * xxx_HOST_INTEREST_ADDRESS is the address in Target RAM of the
  * host_interest structure.  It must match the address of the _host_interest
@@ -445,4 +447,7 @@ Fw Mode/SubMode Mask
 #define QCA988X_BOARD_DATA_SZ     7168
 #define QCA988X_BOARD_EXT_DATA_SZ 0
 
+#define QCA6174_BOARD_DATA_SZ     8192
+#define QCA6174_BOARD_EXT_DATA_SZ 0
+
 #endif /* __TARGADDRS_H__ */
diff --git a/drivers/net/wireless/ath/ath10k/testmode.c b/drivers/net/wireless/ath/ath10k/testmode.c
index 483db9cb8c96..b084f88da102 100644
--- a/drivers/net/wireless/ath/ath10k/testmode.c
+++ b/drivers/net/wireless/ath/ath10k/testmode.c
@@ -187,13 +187,14 @@ static int ath10k_tm_cmd_utf_start(struct ath10k *ar, struct nlattr *tb[])
 
         memcpy(ar->testmode.orig_fw_features, ar->fw_features,
                sizeof(ar->fw_features));
+        ar->testmode.orig_wmi_op_version = ar->wmi.op_version;
 
         /* utf.bin firmware image does not advertise firmware features. Do
          * an ugly hack where we force the firmware features so that wmi.c
          * will use the correct WMI interface.
          */
         memset(ar->fw_features, 0, sizeof(ar->fw_features));
-        __set_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features);
+        ar->wmi.op_version = ATH10K_FW_WMI_OP_VERSION_10_1;
 
         ret = ath10k_hif_power_up(ar);
         if (ret) {
@@ -224,6 +225,7 @@ err_fw_features:
         /* return the original firmware features */
         memcpy(ar->fw_features, ar->testmode.orig_fw_features,
                sizeof(ar->fw_features));
+        ar->wmi.op_version = ar->testmode.orig_wmi_op_version;
 
         release_firmware(ar->testmode.utf);
         ar->testmode.utf = NULL;
@@ -250,6 +252,7 @@ static void __ath10k_tm_cmd_utf_stop(struct ath10k *ar)
         /* return the original firmware features */
         memcpy(ar->fw_features, ar->testmode.orig_fw_features,
                sizeof(ar->fw_features));
+        ar->wmi.op_version = ar->testmode.orig_wmi_op_version;
 
         release_firmware(ar->testmode.utf);
         ar->testmode.utf = NULL;
diff --git a/drivers/net/wireless/ath/ath10k/thermal.c b/drivers/net/wireless/ath/ath10k/thermal.c
new file mode 100644
index 000000000000..aede750809fe
--- /dev/null
+++ b/drivers/net/wireless/ath/ath10k/thermal.c
@@ -0,0 +1,244 @@
+/*
+ * Copyright (c) 2014 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/device.h>
+#include <linux/sysfs.h>
+#include <linux/thermal.h>
+#include <linux/hwmon.h>
+#include <linux/hwmon-sysfs.h>
+#include "core.h"
+#include "debug.h"
+#include "wmi-ops.h"
+
+static int ath10k_thermal_get_active_vifs(struct ath10k *ar,
+                                          enum wmi_vdev_type type)
+{
+        struct ath10k_vif *arvif;
+        int count = 0;
+
+        lockdep_assert_held(&ar->conf_mutex);
+
+        list_for_each_entry(arvif, &ar->arvifs, list) {
+                if (!arvif->is_started)
+                        continue;
+
+                if (!arvif->is_up)
+                        continue;
+
+                if (arvif->vdev_type != type)
+                        continue;
+
+                count++;
+        }
+        return count;
+}
+
+static int ath10k_thermal_get_max_dutycycle(struct thermal_cooling_device *cdev,
+                                            unsigned long *state)
+{
+        *state = ATH10K_QUIET_DUTY_CYCLE_MAX;
+
+        return 0;
+}
+
+static int ath10k_thermal_get_cur_dutycycle(struct thermal_cooling_device *cdev,
+                                            unsigned long *state)
+{
+        struct ath10k *ar = cdev->devdata;
+
+        mutex_lock(&ar->conf_mutex);
+        *state = ar->thermal.duty_cycle;
+        mutex_unlock(&ar->conf_mutex);
+
+        return 0;
+}
+
+static int ath10k_thermal_set_cur_dutycycle(struct thermal_cooling_device *cdev,
+                                            unsigned long duty_cycle)
+{
+        struct ath10k *ar = cdev->devdata;
+        u32 period, duration, enabled;
+        int num_bss, ret = 0;
+
+        mutex_lock(&ar->conf_mutex);
+        if (ar->state != ATH10K_STATE_ON) {
+                ret = -ENETDOWN;
+                goto out;
+        }
+
+        if (duty_cycle > ATH10K_QUIET_DUTY_CYCLE_MAX) {
+                ath10k_warn(ar, "duty cycle %ld is exceeding the limit %d\n",
+                            duty_cycle, ATH10K_QUIET_DUTY_CYCLE_MAX);
+                ret = -EINVAL;
+                goto out;
+        }
+        /* TODO: Right now, thermal mitigation is handled only for single/multi
+         * vif AP mode. Since quiet param is not validated in STA mode, it needs
+         * to be investigated further to handle multi STA and multi-vif (AP+STA)
+         * mode properly.
+         */
+        num_bss = ath10k_thermal_get_active_vifs(ar, WMI_VDEV_TYPE_AP);
+        if (!num_bss) {
+                ath10k_warn(ar, "no active AP interfaces\n");
+                ret = -ENETDOWN;
+                goto out;
+        }
+        period = max(ATH10K_QUIET_PERIOD_MIN,
+                     (ATH10K_QUIET_PERIOD_DEFAULT / num_bss));
+        duration = (period * duty_cycle) / 100;
+        enabled = duration ? 1 : 0;
+
+        ret = ath10k_wmi_pdev_set_quiet_mode(ar, period, duration,
+                                             ATH10K_QUIET_START_OFFSET,
+                                             enabled);
+        if (ret) {
+                ath10k_warn(ar, "failed to set quiet mode period %u duarion %u enabled %u ret %d\n",
+                            period, duration, enabled, ret);
+                goto out;
+        }
+        ar->thermal.duty_cycle = duty_cycle;
+out:
+        mutex_unlock(&ar->conf_mutex);
+        return ret;
+}
+
+static struct thermal_cooling_device_ops ath10k_thermal_ops = {
+        .get_max_state = ath10k_thermal_get_max_dutycycle,
+        .get_cur_state = ath10k_thermal_get_cur_dutycycle,
+        .set_cur_state = ath10k_thermal_set_cur_dutycycle,
+};
+
+static ssize_t ath10k_thermal_show_temp(struct device *dev,
+                                        struct device_attribute *attr,
+                                        char *buf)
+{
+        struct ath10k *ar = dev_get_drvdata(dev);
+        int ret, temperature;
+
+        mutex_lock(&ar->conf_mutex);
+
+        /* Can't get temperature when the card is off */
+        if (ar->state != ATH10K_STATE_ON) {
+                ret = -ENETDOWN;
+                goto out;
+        }
+
+        reinit_completion(&ar->thermal.wmi_sync);
+        ret = ath10k_wmi_pdev_get_temperature(ar);
+        if (ret) {
+                ath10k_warn(ar, "failed to read temperature %d\n", ret);
+                goto out;
+        }
+
+        if (test_bit(ATH10K_FLAG_CRASH_FLUSH, &ar->dev_flags)) {
+                ret = -ESHUTDOWN;
+                goto out;
+        }
+
+        ret = wait_for_completion_timeout(&ar->thermal.wmi_sync,
+                                          ATH10K_THERMAL_SYNC_TIMEOUT_HZ);
+        if (ret == 0) {
+                ath10k_warn(ar, "failed to synchronize thermal read\n");
+                ret = -ETIMEDOUT;
+                goto out;
+        }
+
+        spin_lock_bh(&ar->data_lock);
+        temperature = ar->thermal.temperature;
+        spin_unlock_bh(&ar->data_lock);
+
+        /* display in millidegree celcius */
+        ret = snprintf(buf, PAGE_SIZE, "%d\n", temperature * 1000);
+out:
+        mutex_unlock(&ar->conf_mutex);
+        return ret;
+}
+
+void ath10k_thermal_event_temperature(struct ath10k *ar, int temperature)
+{
+        spin_lock_bh(&ar->data_lock);
+        ar->thermal.temperature = temperature;
+        spin_unlock_bh(&ar->data_lock);
+        complete(&ar->thermal.wmi_sync);
+}
+
+static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO, ath10k_thermal_show_temp,
+                          NULL, 0);
+
+static struct attribute *ath10k_hwmon_attrs[] = {
+        &sensor_dev_attr_temp1_input.dev_attr.attr,
+        NULL,
+};
+ATTRIBUTE_GROUPS(ath10k_hwmon);
+
+int ath10k_thermal_register(struct ath10k *ar)
+{
+        struct thermal_cooling_device *cdev;
+        struct device *hwmon_dev;
+        int ret;
+
+        cdev = thermal_cooling_device_register("ath10k_thermal", ar,
+                                               &ath10k_thermal_ops);
+
+        if (IS_ERR(cdev)) {
+                ath10k_err(ar, "failed to setup thermal device result: %ld\n",
+                           PTR_ERR(cdev));
+                return -EINVAL;
+        }
+
+        ret = sysfs_create_link(&ar->dev->kobj, &cdev->device.kobj,
+                                "cooling_device");
+        if (ret) {
+                ath10k_err(ar, "failed to create thermal symlink\n");
+                goto err_cooling_destroy;
+        }
+
+        ar->thermal.cdev = cdev;
+
+        /* Do not register hwmon device when temperature reading is not
+         * supported by firmware
+         */
+        if (ar->wmi.op_version != ATH10K_FW_WMI_OP_VERSION_10_2_4)
+                return 0;
+
+        /* Avoid linking error on devm_hwmon_device_register_with_groups, I
+         * guess linux/hwmon.h is missing proper stubs. */
+        if (!config_enabled(CONFIG_HWMON))
+                return 0;
+
+        hwmon_dev = devm_hwmon_device_register_with_groups(ar->dev,
+                                                           "ath10k_hwmon", ar,
+                                                           ath10k_hwmon_groups);
+        if (IS_ERR(hwmon_dev)) {
+                ath10k_err(ar, "failed to register hwmon device: %ld\n",
+                           PTR_ERR(hwmon_dev));
+                ret = -EINVAL;
+                goto err_remove_link;
+        }
+        return 0;
+
+err_remove_link:
+        sysfs_remove_link(&ar->dev->kobj, "thermal_sensor");
+err_cooling_destroy:
+        thermal_cooling_device_unregister(cdev);
+        return ret;
+}
+
+void ath10k_thermal_unregister(struct ath10k *ar)
+{
+        thermal_cooling_device_unregister(ar->thermal.cdev);
+        sysfs_remove_link(&ar->dev->kobj, "cooling_device");
+}
diff --git a/drivers/net/wireless/ath/ath10k/thermal.h b/drivers/net/wireless/ath/ath10k/thermal.h
new file mode 100644
index 000000000000..bccc17ae0fde
--- /dev/null
+++ b/drivers/net/wireless/ath/ath10k/thermal.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (c) 2014 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef _THERMAL_
+#define _THERMAL_
+
+#define ATH10K_QUIET_PERIOD_DEFAULT     100
+#define ATH10K_QUIET_PERIOD_MIN         25
+#define ATH10K_QUIET_START_OFFSET       10
+#define ATH10K_QUIET_DUTY_CYCLE_MAX     70
+#define ATH10K_HWMON_NAME_LEN           15
+#define ATH10K_THERMAL_SYNC_TIMEOUT_HZ (5*HZ)
+
+struct ath10k_thermal {
+        struct thermal_cooling_device *cdev;
+        struct completion wmi_sync;
+
+        /* protected by conf_mutex */
+        u32 duty_cycle;
+        /* temperature value in Celcius degree
+         * protected by data_lock
+         */
+        int temperature;
+};
+
+#ifdef CONFIG_THERMAL
+int ath10k_thermal_register(struct ath10k *ar);
+void ath10k_thermal_unregister(struct ath10k *ar);
+void ath10k_thermal_event_temperature(struct ath10k *ar, int temperature);
+#else
+static inline int ath10k_thermal_register(struct ath10k *ar)
+{
+        return 0;
+}
+
+static inline void ath10k_thermal_unregister(struct ath10k *ar)
+{
+}
+
+static inline void ath10k_thermal_event_temperature(struct ath10k *ar,
+                                                    int temperature)
+{
+}
+
+#endif
+#endif /* _THERMAL_ */
diff --git a/drivers/net/wireless/ath/ath10k/trace.h b/drivers/net/wireless/ath/ath10k/trace.h
index b289378b6e3e..5407887380ab 100644
--- a/drivers/net/wireless/ath/ath10k/trace.h
+++ b/drivers/net/wireless/ath/ath10k/trace.h
@@ -453,6 +453,74 @@ TRACE_EVENT(ath10k_htt_rx_desc,
          )
 );
 
+TRACE_EVENT(ath10k_wmi_diag_container,
+            TP_PROTO(struct ath10k *ar,
+                     u8 type,
+                     u32 timestamp,
+                     u32 code,
+                     u16 len,
+                     const void *data),
+
+        TP_ARGS(ar, type, timestamp, code, len, data),
+
+        TP_STRUCT__entry(
+                __string(device, dev_name(ar->dev))
+                __string(driver, dev_driver_string(ar->dev))
+                __field(u8, type)
+                __field(u32, timestamp)
+                __field(u32, code)
+                __field(u16, len)
+                __dynamic_array(u8, data, len)
+        ),
+
+        TP_fast_assign(
+                __assign_str(device, dev_name(ar->dev));
+                __assign_str(driver, dev_driver_string(ar->dev));
+                __entry->type = type;
+                __entry->timestamp = timestamp;
+                __entry->code = code;
+                __entry->len = len;
+                memcpy(__get_dynamic_array(data), data, len);
+        ),
+
+        TP_printk(
+                "%s %s diag container type %hhu timestamp %u code %u len %d",
+                __get_str(driver),
+                __get_str(device),
+                __entry->type,
+                __entry->timestamp,
+                __entry->code,
+                __entry->len
+        )
+);
+
+TRACE_EVENT(ath10k_wmi_diag,
+            TP_PROTO(struct ath10k *ar, const void *data, size_t len),
+
+        TP_ARGS(ar, data, len),
+
+        TP_STRUCT__entry(
+                __string(device, dev_name(ar->dev))
+                __string(driver, dev_driver_string(ar->dev))
+                __field(u16, len)
+                __dynamic_array(u8, data, len)
+        ),
+
+        TP_fast_assign(
+                __assign_str(device, dev_name(ar->dev));
+                __assign_str(driver, dev_driver_string(ar->dev));
+                __entry->len = len;
+                memcpy(__get_dynamic_array(data), data, len);
+        ),
+
+        TP_printk(
+                "%s %s tlv diag len %d",
+                __get_str(driver),
+                __get_str(device),
+                __entry->len
+        )
+);
+
 #endif /* _TRACE_H_ || TRACE_HEADER_MULTI_READ*/
 
 /* we don't want to use include/trace/events */
diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c
index 7579de8e7a8c..3f00cec8aef5 100644
--- a/drivers/net/wireless/ath/ath10k/txrx.c
+++ b/drivers/net/wireless/ath/ath10k/txrx.c
@@ -64,7 +64,13 @@ void ath10k_txrx_tx_unref(struct ath10k_htt *htt,
                 return;
         }
 
-        msdu = htt->pending_tx[tx_done->msdu_id];
+        msdu = idr_find(&htt->pending_tx, tx_done->msdu_id);
+        if (!msdu) {
+                ath10k_warn(ar, "received tx completion for invalid msdu_id: %d\n",
+                            tx_done->msdu_id);
+                return;
+        }
+
         skb_cb = ATH10K_SKB_CB(msdu);
 
         dma_unmap_single(dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
@@ -95,7 +101,6 @@ void ath10k_txrx_tx_unref(struct ath10k_htt *htt,
         /* we do not own the msdu anymore */
 
 exit:
-        htt->pending_tx[tx_done->msdu_id] = NULL;
         ath10k_htt_tx_free_msdu_id(htt, tx_done->msdu_id);
         __ath10k_htt_tx_dec_pending(htt);
         if (htt->num_pending_tx == 0)
diff --git a/drivers/net/wireless/ath/ath10k/wmi-ops.h b/drivers/net/wireless/ath/ath10k/wmi-ops.h
new file mode 100644
index 000000000000..04dc4b9db04e
--- /dev/null
+++ b/drivers/net/wireless/ath/ath10k/wmi-ops.h
@@ -0,0 +1,1064 @@
+/*
+ * Copyright (c) 2005-2011 Atheros Communications Inc.
+ * Copyright (c) 2011-2014 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _WMI_OPS_H_
+#define _WMI_OPS_H_
+
+struct ath10k;
+struct sk_buff;
+
+struct wmi_ops {
+        void (*rx)(struct ath10k *ar, struct sk_buff *skb);
+        void (*map_svc)(const __le32 *in, unsigned long *out, size_t len);
+
+        int (*pull_scan)(struct ath10k *ar, struct sk_buff *skb,
+                         struct wmi_scan_ev_arg *arg);
+        int (*pull_mgmt_rx)(struct ath10k *ar, struct sk_buff *skb,
+                            struct wmi_mgmt_rx_ev_arg *arg);
+        int (*pull_ch_info)(struct ath10k *ar, struct sk_buff *skb,
+                            struct wmi_ch_info_ev_arg *arg);
+        int (*pull_vdev_start)(struct ath10k *ar, struct sk_buff *skb,
+                               struct wmi_vdev_start_ev_arg *arg);
+        int (*pull_peer_kick)(struct ath10k *ar, struct sk_buff *skb,
+                              struct wmi_peer_kick_ev_arg *arg);
+        int (*pull_swba)(struct ath10k *ar, struct sk_buff *skb,
+                         struct wmi_swba_ev_arg *arg);
+        int (*pull_phyerr)(struct ath10k *ar, struct sk_buff *skb,
+                           struct wmi_phyerr_ev_arg *arg);
+        int (*pull_svc_rdy)(struct ath10k *ar, struct sk_buff *skb,
+                            struct wmi_svc_rdy_ev_arg *arg);
+        int (*pull_rdy)(struct ath10k *ar, struct sk_buff *skb,
+                        struct wmi_rdy_ev_arg *arg);
+        int (*pull_fw_stats)(struct ath10k *ar, struct sk_buff *skb,
+                             struct ath10k_fw_stats *stats);
+
+        struct sk_buff *(*gen_pdev_suspend)(struct ath10k *ar, u32 suspend_opt);
+        struct sk_buff *(*gen_pdev_resume)(struct ath10k *ar);
+        struct sk_buff *(*gen_pdev_set_rd)(struct ath10k *ar, u16 rd, u16 rd2g,
+                                           u16 rd5g, u16 ctl2g, u16 ctl5g,
+                                           enum wmi_dfs_region dfs_reg);
+        struct sk_buff *(*gen_pdev_set_param)(struct ath10k *ar, u32 id,
+                                              u32 value);
+        struct sk_buff *(*gen_init)(struct ath10k *ar);
+        struct sk_buff *(*gen_start_scan)(struct ath10k *ar,
+                                          const struct wmi_start_scan_arg *arg);
+        struct sk_buff *(*gen_stop_scan)(struct ath10k *ar,
+                                         const struct wmi_stop_scan_arg *arg);
+        struct sk_buff *(*gen_vdev_create)(struct ath10k *ar, u32 vdev_id,
+                                           enum wmi_vdev_type type,
+                                           enum wmi_vdev_subtype subtype,
+                                           const u8 macaddr[ETH_ALEN]);
+        struct sk_buff *(*gen_vdev_delete)(struct ath10k *ar, u32 vdev_id);
+        struct sk_buff *(*gen_vdev_start)(struct ath10k *ar,
+                                          const struct wmi_vdev_start_request_arg *arg,
+                                          bool restart);
+        struct sk_buff *(*gen_vdev_stop)(struct ath10k *ar, u32 vdev_id);
+        struct sk_buff *(*gen_vdev_up)(struct ath10k *ar, u32 vdev_id, u32 aid,
+                                       const u8 *bssid);
+        struct sk_buff *(*gen_vdev_down)(struct ath10k *ar, u32 vdev_id);
+        struct sk_buff *(*gen_vdev_set_param)(struct ath10k *ar, u32 vdev_id,
+                                              u32 param_id, u32 param_value);
+        struct sk_buff *(*gen_vdev_install_key)(struct ath10k *ar,
+                                                const struct wmi_vdev_install_key_arg *arg);
+        struct sk_buff *(*gen_vdev_spectral_conf)(struct ath10k *ar,
+                                                  const struct wmi_vdev_spectral_conf_arg *arg);
+        struct sk_buff *(*gen_vdev_spectral_enable)(struct ath10k *ar, u32 vdev_id,
+                                                    u32 trigger, u32 enable);
+        struct sk_buff *(*gen_vdev_wmm_conf)(struct ath10k *ar, u32 vdev_id,
+                                             const struct wmi_wmm_params_all_arg *arg);
+        struct sk_buff *(*gen_peer_create)(struct ath10k *ar, u32 vdev_id,
+                                           const u8 peer_addr[ETH_ALEN]);
+        struct sk_buff *(*gen_peer_delete)(struct ath10k *ar, u32 vdev_id,
+                                           const u8 peer_addr[ETH_ALEN]);
+        struct sk_buff *(*gen_peer_flush)(struct ath10k *ar, u32 vdev_id,
+                                          const u8 peer_addr[ETH_ALEN],
+                                          u32 tid_bitmap);
+        struct sk_buff *(*gen_peer_set_param)(struct ath10k *ar, u32 vdev_id,
+                                              const u8 *peer_addr,
+                                              enum wmi_peer_param param_id,
+                                              u32 param_value);
+        struct sk_buff *(*gen_peer_assoc)(struct ath10k *ar,
+                                          const struct wmi_peer_assoc_complete_arg *arg);
+        struct sk_buff *(*gen_set_psmode)(struct ath10k *ar, u32 vdev_id,
+                                          enum wmi_sta_ps_mode psmode);
+        struct sk_buff *(*gen_set_sta_ps)(struct ath10k *ar, u32 vdev_id,
+                                          enum wmi_sta_powersave_param param_id,
+                                          u32 value);
+        struct sk_buff *(*gen_set_ap_ps)(struct ath10k *ar, u32 vdev_id,
+                                         const u8 *mac,
+                                         enum wmi_ap_ps_peer_param param_id,
+                                         u32 value);
+        struct sk_buff *(*gen_scan_chan_list)(struct ath10k *ar,
+                                              const struct wmi_scan_chan_list_arg *arg);
+        struct sk_buff *(*gen_beacon_dma)(struct ath10k *ar, u32 vdev_id,
+                                          const void *bcn, size_t bcn_len,
+                                          u32 bcn_paddr, bool dtim_zero,
+                                          bool deliver_cab);
+        struct sk_buff *(*gen_pdev_set_wmm)(struct ath10k *ar,
+                                            const struct wmi_wmm_params_all_arg *arg);
+        struct sk_buff *(*gen_request_stats)(struct ath10k *ar,
+                                             enum wmi_stats_id stats_id);
+        struct sk_buff *(*gen_force_fw_hang)(struct ath10k *ar,
+                                             enum wmi_force_fw_hang_type type,
+                                             u32 delay_ms);
+        struct sk_buff *(*gen_mgmt_tx)(struct ath10k *ar, struct sk_buff *skb);
+        struct sk_buff *(*gen_dbglog_cfg)(struct ath10k *ar, u32 module_enable,
+                                          u32 log_level);
+        struct sk_buff *(*gen_pktlog_enable)(struct ath10k *ar, u32 filter);
+        struct sk_buff *(*gen_pktlog_disable)(struct ath10k *ar);
+        struct sk_buff *(*gen_pdev_set_quiet_mode)(struct ath10k *ar,
+                                                   u32 period, u32 duration,
+                                                   u32 next_offset,
+                                                   u32 enabled);
+        struct sk_buff *(*gen_pdev_get_temperature)(struct ath10k *ar);
+        struct sk_buff *(*gen_addba_clear_resp)(struct ath10k *ar, u32 vdev_id,
+                                                const u8 *mac);
+        struct sk_buff *(*gen_addba_send)(struct ath10k *ar, u32 vdev_id,
+                                          const u8 *mac, u32 tid, u32 buf_size);
+        struct sk_buff *(*gen_addba_set_resp)(struct ath10k *ar, u32 vdev_id,
+                                              const u8 *mac, u32 tid,
+                                              u32 status);
+        struct sk_buff *(*gen_delba_send)(struct ath10k *ar, u32 vdev_id,
+                                          const u8 *mac, u32 tid, u32 initiator,
+                                          u32 reason);
+        struct sk_buff *(*gen_bcn_tmpl)(struct ath10k *ar, u32 vdev_id,
+                                        u32 tim_ie_offset, struct sk_buff *bcn,
+                                        u32 prb_caps, u32 prb_erp,
+                                        void *prb_ies, size_t prb_ies_len);
+        struct sk_buff *(*gen_prb_tmpl)(struct ath10k *ar, u32 vdev_id,
+                                        struct sk_buff *bcn);
+        struct sk_buff *(*gen_p2p_go_bcn_ie)(struct ath10k *ar, u32 vdev_id,
+                                             const u8 *p2p_ie);
+        struct sk_buff *(*gen_vdev_sta_uapsd)(struct ath10k *ar, u32 vdev_id,
+                                              const u8 peer_addr[ETH_ALEN],
+                                              const struct wmi_sta_uapsd_auto_trig_arg *args,
+                                              u32 num_ac);
+        struct sk_buff *(*gen_sta_keepalive)(struct ath10k *ar,
+                                             const struct wmi_sta_keepalive_arg *arg);
+};
+
+int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id);
+
+static inline int
+ath10k_wmi_rx(struct ath10k *ar, struct sk_buff *skb)
+{
+        if (WARN_ON_ONCE(!ar->wmi.ops->rx))
+                return -EOPNOTSUPP;
+
+        ar->wmi.ops->rx(ar, skb);
+        return 0;
+}
+
+static inline int
+ath10k_wmi_map_svc(struct ath10k *ar, const __le32 *in, unsigned long *out,
+                   size_t len)
+{
+        if (!ar->wmi.ops->map_svc)
+                return -EOPNOTSUPP;
+
+        ar->wmi.ops->map_svc(in, out, len);
+        return 0;
+}
+
+static inline int
+ath10k_wmi_pull_scan(struct ath10k *ar, struct sk_buff *skb,
+                     struct wmi_scan_ev_arg *arg)
+{
+        if (!ar->wmi.ops->pull_scan)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_scan(ar, skb, arg);
+}
+
+static inline int
+ath10k_wmi_pull_mgmt_rx(struct ath10k *ar, struct sk_buff *skb,
+                        struct wmi_mgmt_rx_ev_arg *arg)
+{
+        if (!ar->wmi.ops->pull_mgmt_rx)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_mgmt_rx(ar, skb, arg);
+}
+
+static inline int
+ath10k_wmi_pull_ch_info(struct ath10k *ar, struct sk_buff *skb,
+                        struct wmi_ch_info_ev_arg *arg)
+{
+        if (!ar->wmi.ops->pull_ch_info)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_ch_info(ar, skb, arg);
+}
+
+static inline int
+ath10k_wmi_pull_vdev_start(struct ath10k *ar, struct sk_buff *skb,
+                           struct wmi_vdev_start_ev_arg *arg)
+{
+        if (!ar->wmi.ops->pull_vdev_start)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_vdev_start(ar, skb, arg);
+}
+
+static inline int
+ath10k_wmi_pull_peer_kick(struct ath10k *ar, struct sk_buff *skb,
+                          struct wmi_peer_kick_ev_arg *arg)
+{
+        if (!ar->wmi.ops->pull_peer_kick)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_peer_kick(ar, skb, arg);
+}
+
+static inline int
+ath10k_wmi_pull_swba(struct ath10k *ar, struct sk_buff *skb,
+                     struct wmi_swba_ev_arg *arg)
+{
+        if (!ar->wmi.ops->pull_swba)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_swba(ar, skb, arg);
+}
+
+static inline int
+ath10k_wmi_pull_phyerr(struct ath10k *ar, struct sk_buff *skb,
+                       struct wmi_phyerr_ev_arg *arg)
+{
+        if (!ar->wmi.ops->pull_phyerr)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_phyerr(ar, skb, arg);
+}
+
+static inline int
+ath10k_wmi_pull_svc_rdy(struct ath10k *ar, struct sk_buff *skb,
+                        struct wmi_svc_rdy_ev_arg *arg)
+{
+        if (!ar->wmi.ops->pull_svc_rdy)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_svc_rdy(ar, skb, arg);
+}
+
+static inline int
+ath10k_wmi_pull_rdy(struct ath10k *ar, struct sk_buff *skb,
+                    struct wmi_rdy_ev_arg *arg)
+{
+        if (!ar->wmi.ops->pull_rdy)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_rdy(ar, skb, arg);
+}
+
+static inline int
+ath10k_wmi_pull_fw_stats(struct ath10k *ar, struct sk_buff *skb,
+                         struct ath10k_fw_stats *stats)
+{
+        if (!ar->wmi.ops->pull_fw_stats)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_fw_stats(ar, skb, stats);
+}
+
+static inline int
+ath10k_wmi_mgmt_tx(struct ath10k *ar, struct sk_buff *msdu)
+{
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(msdu);
+        struct sk_buff *skb;
+        int ret;
+
+        if (!ar->wmi.ops->gen_mgmt_tx)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_mgmt_tx(ar, msdu);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        ret = ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->mgmt_tx_cmdid);
+        if (ret)
+                return ret;
+
+        /* FIXME There's no ACK event for Management Tx. This probably
+         * shouldn't be called here either. */
+        info->flags |= IEEE80211_TX_STAT_ACK;
+        ieee80211_tx_status_irqsafe(ar->hw, msdu);
+
+        return 0;
+}
+
+static inline int
+ath10k_wmi_pdev_set_regdomain(struct ath10k *ar, u16 rd, u16 rd2g, u16 rd5g,
+                              u16 ctl2g, u16 ctl5g,
+                              enum wmi_dfs_region dfs_reg)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_pdev_set_rd)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_pdev_set_rd(ar, rd, rd2g, rd5g, ctl2g, ctl5g,
+                                           dfs_reg);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->pdev_set_regdomain_cmdid);
+}
+
+static inline int
+ath10k_wmi_pdev_suspend_target(struct ath10k *ar, u32 suspend_opt)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_pdev_suspend)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_pdev_suspend(ar, suspend_opt);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->pdev_suspend_cmdid);
+}
+
+static inline int
+ath10k_wmi_pdev_resume_target(struct ath10k *ar)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_pdev_resume)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_pdev_resume(ar);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->pdev_resume_cmdid);
+}
+
+static inline int
+ath10k_wmi_pdev_set_param(struct ath10k *ar, u32 id, u32 value)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_pdev_set_param)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_pdev_set_param(ar, id, value);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->pdev_set_param_cmdid);
+}
+
+static inline int
+ath10k_wmi_cmd_init(struct ath10k *ar)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_init)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_init(ar);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->init_cmdid);
+}
+
+static inline int
+ath10k_wmi_start_scan(struct ath10k *ar,
+                      const struct wmi_start_scan_arg *arg)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_start_scan)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_start_scan(ar, arg);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->start_scan_cmdid);
+}
+
+static inline int
+ath10k_wmi_stop_scan(struct ath10k *ar, const struct wmi_stop_scan_arg *arg)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_stop_scan)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_stop_scan(ar, arg);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->stop_scan_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_create(struct ath10k *ar, u32 vdev_id,
+                       enum wmi_vdev_type type,
+                       enum wmi_vdev_subtype subtype,
+                       const u8 macaddr[ETH_ALEN])
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_vdev_create)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_vdev_create(ar, vdev_id, type, subtype, macaddr);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_create_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_delete(struct ath10k *ar, u32 vdev_id)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_vdev_delete)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_vdev_delete(ar, vdev_id);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_delete_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_start(struct ath10k *ar,
+                      const struct wmi_vdev_start_request_arg *arg)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_vdev_start)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_vdev_start(ar, arg, false);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->vdev_start_request_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_restart(struct ath10k *ar,
+                        const struct wmi_vdev_start_request_arg *arg)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_vdev_start)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_vdev_start(ar, arg, true);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->vdev_restart_request_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_stop(struct ath10k *ar, u32 vdev_id)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_vdev_stop)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_vdev_stop(ar, vdev_id);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_stop_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_up(struct ath10k *ar, u32 vdev_id, u32 aid, const u8 *bssid)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_vdev_up)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_vdev_up(ar, vdev_id, aid, bssid);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_up_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_down(struct ath10k *ar, u32 vdev_id)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_vdev_down)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_vdev_down(ar, vdev_id);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_down_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_set_param(struct ath10k *ar, u32 vdev_id, u32 param_id,
+                          u32 param_value)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_vdev_set_param)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_vdev_set_param(ar, vdev_id, param_id,
+                                              param_value);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_set_param_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_install_key(struct ath10k *ar,
+                            const struct wmi_vdev_install_key_arg *arg)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_vdev_install_key)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_vdev_install_key(ar, arg);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->vdev_install_key_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_spectral_conf(struct ath10k *ar,
+                              const struct wmi_vdev_spectral_conf_arg *arg)
+{
+        struct sk_buff *skb;
+        u32 cmd_id;
+
+        skb = ar->wmi.ops->gen_vdev_spectral_conf(ar, arg);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        cmd_id = ar->wmi.cmd->vdev_spectral_scan_configure_cmdid;
+        return ath10k_wmi_cmd_send(ar, skb, cmd_id);
+}
+
+static inline int
+ath10k_wmi_vdev_spectral_enable(struct ath10k *ar, u32 vdev_id, u32 trigger,
+                                u32 enable)
+{
+        struct sk_buff *skb;
+        u32 cmd_id;
+
+        skb = ar->wmi.ops->gen_vdev_spectral_enable(ar, vdev_id, trigger,
+                                                    enable);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        cmd_id = ar->wmi.cmd->vdev_spectral_scan_enable_cmdid;
+        return ath10k_wmi_cmd_send(ar, skb, cmd_id);
+}
+
+static inline int
+ath10k_wmi_vdev_sta_uapsd(struct ath10k *ar, u32 vdev_id,
+                          const u8 peer_addr[ETH_ALEN],
+                          const struct wmi_sta_uapsd_auto_trig_arg *args,
+                          u32 num_ac)
+{
+        struct sk_buff *skb;
+        u32 cmd_id;
+
+        if (!ar->wmi.ops->gen_vdev_sta_uapsd)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_vdev_sta_uapsd(ar, vdev_id, peer_addr, args,
+                                              num_ac);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        cmd_id = ar->wmi.cmd->sta_uapsd_auto_trig_cmdid;
+        return ath10k_wmi_cmd_send(ar, skb, cmd_id);
+}
+
+static inline int
+ath10k_wmi_vdev_wmm_conf(struct ath10k *ar, u32 vdev_id,
+                         const struct wmi_wmm_params_all_arg *arg)
+{
+        struct sk_buff *skb;
+        u32 cmd_id;
+
+        skb = ar->wmi.ops->gen_vdev_wmm_conf(ar, vdev_id, arg);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        cmd_id = ar->wmi.cmd->vdev_set_wmm_params_cmdid;
+        return ath10k_wmi_cmd_send(ar, skb, cmd_id);
+}
+
+static inline int
+ath10k_wmi_peer_create(struct ath10k *ar, u32 vdev_id,
+                       const u8 peer_addr[ETH_ALEN])
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_peer_create)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_peer_create(ar, vdev_id, peer_addr);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_create_cmdid);
+}
+
+static inline int
+ath10k_wmi_peer_delete(struct ath10k *ar, u32 vdev_id,
+                       const u8 peer_addr[ETH_ALEN])
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_peer_delete)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_peer_delete(ar, vdev_id, peer_addr);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_delete_cmdid);
+}
+
+static inline int
+ath10k_wmi_peer_flush(struct ath10k *ar, u32 vdev_id,
+                      const u8 peer_addr[ETH_ALEN], u32 tid_bitmap)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_peer_flush)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_peer_flush(ar, vdev_id, peer_addr, tid_bitmap);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_flush_tids_cmdid);
+}
+
+static inline int
+ath10k_wmi_peer_set_param(struct ath10k *ar, u32 vdev_id, const u8 *peer_addr,
+                          enum wmi_peer_param param_id, u32 param_value)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_peer_set_param)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_peer_set_param(ar, vdev_id, peer_addr, param_id,
+                                              param_value);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_set_param_cmdid);
+}
+
+static inline int
+ath10k_wmi_set_psmode(struct ath10k *ar, u32 vdev_id,
+                      enum wmi_sta_ps_mode psmode)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_set_psmode)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_set_psmode(ar, vdev_id, psmode);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->sta_powersave_mode_cmdid);
+}
+
+static inline int
+ath10k_wmi_set_sta_ps_param(struct ath10k *ar, u32 vdev_id,
+                            enum wmi_sta_powersave_param param_id, u32 value)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_set_sta_ps)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_set_sta_ps(ar, vdev_id, param_id, value);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->sta_powersave_param_cmdid);
+}
+
+static inline int
+ath10k_wmi_set_ap_ps_param(struct ath10k *ar, u32 vdev_id, const u8 *mac,
+                           enum wmi_ap_ps_peer_param param_id, u32 value)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_set_ap_ps)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_set_ap_ps(ar, vdev_id, mac, param_id, value);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->ap_ps_peer_param_cmdid);
+}
+
+static inline int
+ath10k_wmi_scan_chan_list(struct ath10k *ar,
+                          const struct wmi_scan_chan_list_arg *arg)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_scan_chan_list)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_scan_chan_list(ar, arg);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->scan_chan_list_cmdid);
+}
+
+static inline int
+ath10k_wmi_peer_assoc(struct ath10k *ar,
+                      const struct wmi_peer_assoc_complete_arg *arg)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_peer_assoc)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_peer_assoc(ar, arg);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_assoc_cmdid);
+}
+
+static inline int
+ath10k_wmi_beacon_send_ref_nowait(struct ath10k *ar, u32 vdev_id,
+                                  const void *bcn, size_t bcn_len,
+                                  u32 bcn_paddr, bool dtim_zero,
+                                  bool deliver_cab)
+{
+        struct sk_buff *skb;
+        int ret;
+
+        if (!ar->wmi.ops->gen_beacon_dma)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_beacon_dma(ar, vdev_id, bcn, bcn_len, bcn_paddr,
+                                          dtim_zero, deliver_cab);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        ret = ath10k_wmi_cmd_send_nowait(ar, skb,
+                                         ar->wmi.cmd->pdev_send_bcn_cmdid);
+        if (ret) {
+                dev_kfree_skb(skb);
+                return ret;
+        }
+
+        return 0;
+}
+
+static inline int
+ath10k_wmi_pdev_set_wmm_params(struct ath10k *ar,
+                               const struct wmi_wmm_params_all_arg *arg)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_pdev_set_wmm)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_pdev_set_wmm(ar, arg);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->pdev_set_wmm_params_cmdid);
+}
+
+static inline int
+ath10k_wmi_request_stats(struct ath10k *ar, enum wmi_stats_id stats_id)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_request_stats)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_request_stats(ar, stats_id);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->request_stats_cmdid);
+}
+
+static inline int
+ath10k_wmi_force_fw_hang(struct ath10k *ar,
+                         enum wmi_force_fw_hang_type type, u32 delay_ms)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_force_fw_hang)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_force_fw_hang(ar, type, delay_ms);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->force_fw_hang_cmdid);
+}
+
+static inline int
+ath10k_wmi_dbglog_cfg(struct ath10k *ar, u32 module_enable, u32 log_level)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_dbglog_cfg)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_dbglog_cfg(ar, module_enable, log_level);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->dbglog_cfg_cmdid);
+}
+
+static inline int
+ath10k_wmi_pdev_pktlog_enable(struct ath10k *ar, u32 filter)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_pktlog_enable)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_pktlog_enable(ar, filter);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->pdev_pktlog_enable_cmdid);
+}
+
+static inline int
+ath10k_wmi_pdev_pktlog_disable(struct ath10k *ar)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_pktlog_disable)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_pktlog_disable(ar);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->pdev_pktlog_disable_cmdid);
+}
+
+static inline int
+ath10k_wmi_pdev_set_quiet_mode(struct ath10k *ar, u32 period, u32 duration,
+                               u32 next_offset, u32 enabled)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_pdev_set_quiet_mode)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_pdev_set_quiet_mode(ar, period, duration,
+                                                   next_offset, enabled);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->pdev_set_quiet_mode_cmdid);
+}
+
+static inline int
+ath10k_wmi_pdev_get_temperature(struct ath10k *ar)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_pdev_get_temperature)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_pdev_get_temperature(ar);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->pdev_get_temperature_cmdid);
+}
+
+static inline int
+ath10k_wmi_addba_clear_resp(struct ath10k *ar, u32 vdev_id, const u8 *mac)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_addba_clear_resp)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_addba_clear_resp(ar, vdev_id, mac);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->addba_clear_resp_cmdid);
+}
+
+static inline int
+ath10k_wmi_addba_send(struct ath10k *ar, u32 vdev_id, const u8 *mac,
+                      u32 tid, u32 buf_size)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_addba_send)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_addba_send(ar, vdev_id, mac, tid, buf_size);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->addba_send_cmdid);
+}
+
+static inline int
+ath10k_wmi_addba_set_resp(struct ath10k *ar, u32 vdev_id, const u8 *mac,
+                          u32 tid, u32 status)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_addba_set_resp)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_addba_set_resp(ar, vdev_id, mac, tid, status);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->addba_set_resp_cmdid);
+}
+
+static inline int
+ath10k_wmi_delba_send(struct ath10k *ar, u32 vdev_id, const u8 *mac,
+                      u32 tid, u32 initiator, u32 reason)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_delba_send)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_delba_send(ar, vdev_id, mac, tid, initiator,
+                                          reason);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->delba_send_cmdid);
+}
+
+static inline int
+ath10k_wmi_bcn_tmpl(struct ath10k *ar, u32 vdev_id, u32 tim_ie_offset,
+                    struct sk_buff *bcn, u32 prb_caps, u32 prb_erp,
+                    void *prb_ies, size_t prb_ies_len)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_bcn_tmpl)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_bcn_tmpl(ar, vdev_id, tim_ie_offset, bcn,
+                                        prb_caps, prb_erp, prb_ies,
+                                        prb_ies_len);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->bcn_tmpl_cmdid);
+}
+
+static inline int
+ath10k_wmi_prb_tmpl(struct ath10k *ar, u32 vdev_id, struct sk_buff *prb)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_prb_tmpl)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_prb_tmpl(ar, vdev_id, prb);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->prb_tmpl_cmdid);
+}
+
+static inline int
+ath10k_wmi_p2p_go_bcn_ie(struct ath10k *ar, u32 vdev_id, const u8 *p2p_ie)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_p2p_go_bcn_ie)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_p2p_go_bcn_ie(ar, vdev_id, p2p_ie);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->p2p_go_set_beacon_ie);
+}
+
+static inline int
+ath10k_wmi_sta_keepalive(struct ath10k *ar,
+                         const struct wmi_sta_keepalive_arg *arg)
+{
+        struct sk_buff *skb;
+        u32 cmd_id;
+
+        if (!ar->wmi.ops->gen_sta_keepalive)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_sta_keepalive(ar, arg);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        cmd_id = ar->wmi.cmd->sta_keepalive_cmd;
+        return ath10k_wmi_cmd_send(ar, skb, cmd_id);
+}
+
+#endif
diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
new file mode 100644
index 000000000000..71614ba1b145
--- /dev/null
+++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
@@ -0,0 +1,2696 @@
+/*
+ * Copyright (c) 2005-2011 Atheros Communications Inc.
+ * Copyright (c) 2011-2014 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#include "core.h"
+#include "debug.h"
+#include "hw.h"
+#include "wmi.h"
+#include "wmi-ops.h"
+#include "wmi-tlv.h"
+
+/***************/
+/* TLV helpers */
+/**************/
+
+struct wmi_tlv_policy {
+        size_t min_len;
+};
+
+static const struct wmi_tlv_policy wmi_tlv_policies[] = {
+        [WMI_TLV_TAG_ARRAY_BYTE]
+                = { .min_len = sizeof(u8) },
+        [WMI_TLV_TAG_ARRAY_UINT32]
+                = { .min_len = sizeof(u32) },
+        [WMI_TLV_TAG_STRUCT_SCAN_EVENT]
+                = { .min_len = sizeof(struct wmi_scan_event) },
+        [WMI_TLV_TAG_STRUCT_MGMT_RX_HDR]
+                = { .min_len = sizeof(struct wmi_tlv_mgmt_rx_ev) },
+        [WMI_TLV_TAG_STRUCT_CHAN_INFO_EVENT]
+                = { .min_len = sizeof(struct wmi_chan_info_event) },
+        [WMI_TLV_TAG_STRUCT_VDEV_START_RESPONSE_EVENT]
+                = { .min_len = sizeof(struct wmi_vdev_start_response_event) },
+        [WMI_TLV_TAG_STRUCT_PEER_STA_KICKOUT_EVENT]
+                = { .min_len = sizeof(struct wmi_peer_sta_kickout_event) },
+        [WMI_TLV_TAG_STRUCT_HOST_SWBA_EVENT]
+                = { .min_len = sizeof(struct wmi_host_swba_event) },
+        [WMI_TLV_TAG_STRUCT_TIM_INFO]
+                = { .min_len = sizeof(struct wmi_tim_info) },
+        [WMI_TLV_TAG_STRUCT_P2P_NOA_INFO]
+                = { .min_len = sizeof(struct wmi_p2p_noa_info) },
+        [WMI_TLV_TAG_STRUCT_SERVICE_READY_EVENT]
+                = { .min_len = sizeof(struct wmi_tlv_svc_rdy_ev) },
+        [WMI_TLV_TAG_STRUCT_HAL_REG_CAPABILITIES]
+                = { .min_len = sizeof(struct hal_reg_capabilities) },
+        [WMI_TLV_TAG_STRUCT_WLAN_HOST_MEM_REQ]
+                = { .min_len = sizeof(struct wlan_host_mem_req) },
+        [WMI_TLV_TAG_STRUCT_READY_EVENT]
+                = { .min_len = sizeof(struct wmi_tlv_rdy_ev) },
+        [WMI_TLV_TAG_STRUCT_OFFLOAD_BCN_TX_STATUS_EVENT]
+                = { .min_len = sizeof(struct wmi_tlv_bcn_tx_status_ev) },
+        [WMI_TLV_TAG_STRUCT_DIAG_DATA_CONTAINER_EVENT]
+                = { .min_len = sizeof(struct wmi_tlv_diag_data_ev) },
+};
+
+static int
+ath10k_wmi_tlv_iter(struct ath10k *ar, const void *ptr, size_t len,
+                    int (*iter)(struct ath10k *ar, u16 tag, u16 len,
+                                const void *ptr, void *data),
+                    void *data)
+{
+        const void *begin = ptr;
+        const struct wmi_tlv *tlv;
+        u16 tlv_tag, tlv_len;
+        int ret;
+
+        while (len > 0) {
+                if (len < sizeof(*tlv)) {
+                        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                                   "wmi tlv parse failure at byte %zd (%zu bytes left, %zu expected)\n",
+                                   ptr - begin, len, sizeof(*tlv));
+                        return -EINVAL;
+                }
+
+                tlv = ptr;
+                tlv_tag = __le16_to_cpu(tlv->tag);
+                tlv_len = __le16_to_cpu(tlv->len);
+                ptr += sizeof(*tlv);
+                len -= sizeof(*tlv);
+
+                if (tlv_len > len) {
+                        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                                   "wmi tlv parse failure of tag %hhu at byte %zd (%zu bytes left, %hhu expected)\n",
+                                   tlv_tag, ptr - begin, len, tlv_len);
+                        return -EINVAL;
+                }
+
+                if (tlv_tag < ARRAY_SIZE(wmi_tlv_policies) &&
+                    wmi_tlv_policies[tlv_tag].min_len &&
+                    wmi_tlv_policies[tlv_tag].min_len > tlv_len) {
+                        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                                   "wmi tlv parse failure of tag %hhu at byte %zd (%hhu bytes is less than min length %zu)\n",
+                                   tlv_tag, ptr - begin, tlv_len,
+                                   wmi_tlv_policies[tlv_tag].min_len);
+                        return -EINVAL;
+                }
+
+                ret = iter(ar, tlv_tag, tlv_len, ptr, data);
+                if (ret)
+                        return ret;
+
+                ptr += tlv_len;
+                len -= tlv_len;
+        }
+
+        return 0;
+}
+
+static int ath10k_wmi_tlv_iter_parse(struct ath10k *ar, u16 tag, u16 len,
+                                     const void *ptr, void *data)
+{
+        const void **tb = data;
+
+        if (tag < WMI_TLV_TAG_MAX)
+                tb[tag] = ptr;
+
+        return 0;
+}
+
+static int ath10k_wmi_tlv_parse(struct ath10k *ar, const void **tb,
+                                const void *ptr, size_t len)
+{
+        return ath10k_wmi_tlv_iter(ar, ptr, len, ath10k_wmi_tlv_iter_parse,
+                                   (void *)tb);
+}
+
+static const void **
+ath10k_wmi_tlv_parse_alloc(struct ath10k *ar, const void *ptr,
+                           size_t len, gfp_t gfp)
+{
+        const void **tb;
+        int ret;
+
+        tb = kzalloc(sizeof(*tb) * WMI_TLV_TAG_MAX, gfp);
+        if (!tb)
+                return ERR_PTR(-ENOMEM);
+
+        ret = ath10k_wmi_tlv_parse(ar, tb, ptr, len);
+        if (ret) {
+                kfree(tb);
+                return ERR_PTR(ret);
+        }
+
+        return tb;
+}
+
+static u16 ath10k_wmi_tlv_len(const void *ptr)
+{
+        return __le16_to_cpu((((const struct wmi_tlv *)ptr) - 1)->len);
+}
+
+/**************/
+/* TLV events */
+/**************/
+static int ath10k_wmi_tlv_event_bcn_tx_status(struct ath10k *ar,
+                                              struct sk_buff *skb)
+{
+        const void **tb;
+        const struct wmi_tlv_bcn_tx_status_ev *ev;
+        u32 vdev_id, tx_status;
+        int ret;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_OFFLOAD_BCN_TX_STATUS_EVENT];
+        if (!ev) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        tx_status = __le32_to_cpu(ev->tx_status);
+        vdev_id = __le32_to_cpu(ev->vdev_id);
+
+        switch (tx_status) {
+        case WMI_TLV_BCN_TX_STATUS_OK:
+                break;
+        case WMI_TLV_BCN_TX_STATUS_XRETRY:
+        case WMI_TLV_BCN_TX_STATUS_DROP:
+        case WMI_TLV_BCN_TX_STATUS_FILTERED:
+                /* FIXME: It's probably worth telling mac80211 to stop the
+                 * interface as it is crippled.
+                 */
+                ath10k_warn(ar, "received bcn tmpl tx status on vdev %i: %d",
+                            vdev_id, tx_status);
+                break;
+        }
+
+        kfree(tb);
+        return 0;
+}
+
+static int ath10k_wmi_tlv_event_diag_data(struct ath10k *ar,
+                                          struct sk_buff *skb)
+{
+        const void **tb;
+        const struct wmi_tlv_diag_data_ev *ev;
+        const struct wmi_tlv_diag_item *item;
+        const void *data;
+        int ret, num_items, len;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_DIAG_DATA_CONTAINER_EVENT];
+        data = tb[WMI_TLV_TAG_ARRAY_BYTE];
+        if (!ev || !data) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        num_items = __le32_to_cpu(ev->num_items);
+        len = ath10k_wmi_tlv_len(data);
+
+        while (num_items--) {
+                if (len == 0)
+                        break;
+                if (len < sizeof(*item)) {
+                        ath10k_warn(ar, "failed to parse diag data: can't fit item header\n");
+                        break;
+                }
+
+                item = data;
+
+                if (len < sizeof(*item) + __le16_to_cpu(item->len)) {
+                        ath10k_warn(ar, "failed to parse diag data: item is too long\n");
+                        break;
+                }
+
+                trace_ath10k_wmi_diag_container(ar,
+                                                item->type,
+                                                __le32_to_cpu(item->timestamp),
+                                                __le32_to_cpu(item->code),
+                                                __le16_to_cpu(item->len),
+                                                item->payload);
+
+                len -= sizeof(*item);
+                len -= roundup(__le16_to_cpu(item->len), 4);
+
+                data += sizeof(*item);
+                data += roundup(__le16_to_cpu(item->len), 4);
+        }
+
+        if (num_items != -1 || len != 0)
+                ath10k_warn(ar, "failed to parse diag data event: num_items %d len %d\n",
+                            num_items, len);
+
+        kfree(tb);
+        return 0;
+}
+
+static int ath10k_wmi_tlv_event_diag(struct ath10k *ar,
+                                     struct sk_buff *skb)
+{
+        const void **tb;
+        const void *data;
+        int ret, len;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        data = tb[WMI_TLV_TAG_ARRAY_BYTE];
+        if (!data) {
+                kfree(tb);
+                return -EPROTO;
+        }
+        len = ath10k_wmi_tlv_len(data);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv diag event len %d\n", len);
+        trace_ath10k_wmi_diag(ar, data, len);
+
+        kfree(tb);
+        return 0;
+}
+
+/***********/
+/* TLV ops */
+/***********/
+
+static void ath10k_wmi_tlv_op_rx(struct ath10k *ar, struct sk_buff *skb)
+{
+        struct wmi_cmd_hdr *cmd_hdr;
+        enum wmi_tlv_event_id id;
+
+        cmd_hdr = (struct wmi_cmd_hdr *)skb->data;
+        id = MS(__le32_to_cpu(cmd_hdr->cmd_id), WMI_CMD_HDR_CMD_ID);
+
+        if (skb_pull(skb, sizeof(struct wmi_cmd_hdr)) == NULL)
+                return;
+
+        trace_ath10k_wmi_event(ar, id, skb->data, skb->len);
+
+        switch (id) {
+        case WMI_TLV_MGMT_RX_EVENTID:
+                ath10k_wmi_event_mgmt_rx(ar, skb);
+                /* mgmt_rx() owns the skb now! */
+                return;
+        case WMI_TLV_SCAN_EVENTID:
+                ath10k_wmi_event_scan(ar, skb);
+                break;
+        case WMI_TLV_CHAN_INFO_EVENTID:
+                ath10k_wmi_event_chan_info(ar, skb);
+                break;
+        case WMI_TLV_ECHO_EVENTID:
+                ath10k_wmi_event_echo(ar, skb);
+                break;
+        case WMI_TLV_DEBUG_MESG_EVENTID:
+                ath10k_wmi_event_debug_mesg(ar, skb);
+                break;
+        case WMI_TLV_UPDATE_STATS_EVENTID:
+                ath10k_wmi_event_update_stats(ar, skb);
+                break;
+        case WMI_TLV_VDEV_START_RESP_EVENTID:
+                ath10k_wmi_event_vdev_start_resp(ar, skb);
+                break;
+        case WMI_TLV_VDEV_STOPPED_EVENTID:
+                ath10k_wmi_event_vdev_stopped(ar, skb);
+                break;
+        case WMI_TLV_PEER_STA_KICKOUT_EVENTID:
+                ath10k_wmi_event_peer_sta_kickout(ar, skb);
+                break;
+        case WMI_TLV_HOST_SWBA_EVENTID:
+                ath10k_wmi_event_host_swba(ar, skb);
+                break;
+        case WMI_TLV_TBTTOFFSET_UPDATE_EVENTID:
+                ath10k_wmi_event_tbttoffset_update(ar, skb);
+                break;
+        case WMI_TLV_PHYERR_EVENTID:
+                ath10k_wmi_event_phyerr(ar, skb);
+                break;
+        case WMI_TLV_ROAM_EVENTID:
+                ath10k_wmi_event_roam(ar, skb);
+                break;
+        case WMI_TLV_PROFILE_MATCH:
+                ath10k_wmi_event_profile_match(ar, skb);
+                break;
+        case WMI_TLV_DEBUG_PRINT_EVENTID:
+                ath10k_wmi_event_debug_print(ar, skb);
+                break;
+        case WMI_TLV_PDEV_QVIT_EVENTID:
+                ath10k_wmi_event_pdev_qvit(ar, skb);
+                break;
+        case WMI_TLV_WLAN_PROFILE_DATA_EVENTID:
+                ath10k_wmi_event_wlan_profile_data(ar, skb);
+                break;
+        case WMI_TLV_RTT_MEASUREMENT_REPORT_EVENTID:
+                ath10k_wmi_event_rtt_measurement_report(ar, skb);
+                break;
+        case WMI_TLV_TSF_MEASUREMENT_REPORT_EVENTID:
+                ath10k_wmi_event_tsf_measurement_report(ar, skb);
+                break;
+        case WMI_TLV_RTT_ERROR_REPORT_EVENTID:
+                ath10k_wmi_event_rtt_error_report(ar, skb);
+                break;
+        case WMI_TLV_WOW_WAKEUP_HOST_EVENTID:
+                ath10k_wmi_event_wow_wakeup_host(ar, skb);
+                break;
+        case WMI_TLV_DCS_INTERFERENCE_EVENTID:
+                ath10k_wmi_event_dcs_interference(ar, skb);
+                break;
+        case WMI_TLV_PDEV_TPC_CONFIG_EVENTID:
+                ath10k_wmi_event_pdev_tpc_config(ar, skb);
+                break;
+        case WMI_TLV_PDEV_FTM_INTG_EVENTID:
+                ath10k_wmi_event_pdev_ftm_intg(ar, skb);
+                break;
+        case WMI_TLV_GTK_OFFLOAD_STATUS_EVENTID:
+                ath10k_wmi_event_gtk_offload_status(ar, skb);
+                break;
+        case WMI_TLV_GTK_REKEY_FAIL_EVENTID:
+                ath10k_wmi_event_gtk_rekey_fail(ar, skb);
+                break;
+        case WMI_TLV_TX_DELBA_COMPLETE_EVENTID:
+                ath10k_wmi_event_delba_complete(ar, skb);
+                break;
+        case WMI_TLV_TX_ADDBA_COMPLETE_EVENTID:
+                ath10k_wmi_event_addba_complete(ar, skb);
+                break;
+        case WMI_TLV_VDEV_INSTALL_KEY_COMPLETE_EVENTID:
+                ath10k_wmi_event_vdev_install_key_complete(ar, skb);
+                break;
+        case WMI_TLV_SERVICE_READY_EVENTID:
+                ath10k_wmi_event_service_ready(ar, skb);
+                break;
+        case WMI_TLV_READY_EVENTID:
+                ath10k_wmi_event_ready(ar, skb);
+                break;
+        case WMI_TLV_OFFLOAD_BCN_TX_STATUS_EVENTID:
+                ath10k_wmi_tlv_event_bcn_tx_status(ar, skb);
+                break;
+        case WMI_TLV_DIAG_DATA_CONTAINER_EVENTID:
+                ath10k_wmi_tlv_event_diag_data(ar, skb);
+                break;
+        case WMI_TLV_DIAG_EVENTID:
+                ath10k_wmi_tlv_event_diag(ar, skb);
+                break;
+        default:
+                ath10k_warn(ar, "Unknown eventid: %d\n", id);
+                break;
+        }
+
+        dev_kfree_skb(skb);
+}
+
+static int ath10k_wmi_tlv_op_pull_scan_ev(struct ath10k *ar,
+                                          struct sk_buff *skb,
+                                          struct wmi_scan_ev_arg *arg)
+{
+        const void **tb;
+        const struct wmi_scan_event *ev;
+        int ret;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_SCAN_EVENT];
+        if (!ev) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        arg->event_type = ev->event_type;
+        arg->reason = ev->reason;
+        arg->channel_freq = ev->channel_freq;
+        arg->scan_req_id = ev->scan_req_id;
+        arg->scan_id = ev->scan_id;
+        arg->vdev_id = ev->vdev_id;
+
+        kfree(tb);
+        return 0;
+}
+
+static int ath10k_wmi_tlv_op_pull_mgmt_rx_ev(struct ath10k *ar,
+                                             struct sk_buff *skb,
+                                             struct wmi_mgmt_rx_ev_arg *arg)
+{
+        const void **tb;
+        const struct wmi_tlv_mgmt_rx_ev *ev;
+        const u8 *frame;
+        u32 msdu_len;
+        int ret;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_MGMT_RX_HDR];
+        frame = tb[WMI_TLV_TAG_ARRAY_BYTE];
+
+        if (!ev || !frame) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        arg->channel = ev->channel;
+        arg->buf_len = ev->buf_len;
+        arg->status = ev->status;
+        arg->snr = ev->snr;
+        arg->phy_mode = ev->phy_mode;
+        arg->rate = ev->rate;
+
+        msdu_len = __le32_to_cpu(arg->buf_len);
+
+        if (skb->len < (frame - skb->data) + msdu_len) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        /* shift the sk_buff to point to `frame` */
+        skb_trim(skb, 0);
+        skb_put(skb, frame - skb->data);
+        skb_pull(skb, frame - skb->data);
+        skb_put(skb, msdu_len);
+
+        kfree(tb);
+        return 0;
+}
+
+static int ath10k_wmi_tlv_op_pull_ch_info_ev(struct ath10k *ar,
+                                             struct sk_buff *skb,
+                                             struct wmi_ch_info_ev_arg *arg)
+{
+        const void **tb;
+        const struct wmi_chan_info_event *ev;
+        int ret;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_CHAN_INFO_EVENT];
+        if (!ev) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        arg->err_code = ev->err_code;
+        arg->freq = ev->freq;
+        arg->cmd_flags = ev->cmd_flags;
+        arg->noise_floor = ev->noise_floor;
+        arg->rx_clear_count = ev->rx_clear_count;
+        arg->cycle_count = ev->cycle_count;
+
+        kfree(tb);
+        return 0;
+}
+
+static int
+ath10k_wmi_tlv_op_pull_vdev_start_ev(struct ath10k *ar, struct sk_buff *skb,
+                                     struct wmi_vdev_start_ev_arg *arg)
+{
+        const void **tb;
+        const struct wmi_vdev_start_response_event *ev;
+        int ret;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_VDEV_START_RESPONSE_EVENT];
+        if (!ev) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        skb_pull(skb, sizeof(*ev));
+        arg->vdev_id = ev->vdev_id;
+        arg->req_id = ev->req_id;
+        arg->resp_type = ev->resp_type;
+        arg->status = ev->status;
+
+        kfree(tb);
+        return 0;
+}
+
+static int ath10k_wmi_tlv_op_pull_peer_kick_ev(struct ath10k *ar,
+                                               struct sk_buff *skb,
+                                               struct wmi_peer_kick_ev_arg *arg)
+{
+        const void **tb;
+        const struct wmi_peer_sta_kickout_event *ev;
+        int ret;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_PEER_STA_KICKOUT_EVENT];
+        if (!ev) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        arg->mac_addr = ev->peer_macaddr.addr;
+
+        kfree(tb);
+        return 0;
+}
+
+struct wmi_tlv_swba_parse {
+        const struct wmi_host_swba_event *ev;
+        bool tim_done;
+        bool noa_done;
+        size_t n_tim;
+        size_t n_noa;
+        struct wmi_swba_ev_arg *arg;
+};
+
+static int ath10k_wmi_tlv_swba_tim_parse(struct ath10k *ar, u16 tag, u16 len,
+                                         const void *ptr, void *data)
+{
+        struct wmi_tlv_swba_parse *swba = data;
+
+        if (tag != WMI_TLV_TAG_STRUCT_TIM_INFO)
+                return -EPROTO;
+
+        if (swba->n_tim >= ARRAY_SIZE(swba->arg->tim_info))
+                return -ENOBUFS;
+
+        swba->arg->tim_info[swba->n_tim++] = ptr;
+        return 0;
+}
+
+static int ath10k_wmi_tlv_swba_noa_parse(struct ath10k *ar, u16 tag, u16 len,
+                                         const void *ptr, void *data)
+{
+        struct wmi_tlv_swba_parse *swba = data;
+
+        if (tag != WMI_TLV_TAG_STRUCT_P2P_NOA_INFO)
+                return -EPROTO;
+
+        if (swba->n_noa >= ARRAY_SIZE(swba->arg->noa_info))
+                return -ENOBUFS;
+
+        swba->arg->noa_info[swba->n_noa++] = ptr;
+        return 0;
+}
+
+static int ath10k_wmi_tlv_swba_parse(struct ath10k *ar, u16 tag, u16 len,
+                                     const void *ptr, void *data)
+{
+        struct wmi_tlv_swba_parse *swba = data;
+        int ret;
+
+        switch (tag) {
+        case WMI_TLV_TAG_STRUCT_HOST_SWBA_EVENT:
+                swba->ev = ptr;
+                break;
+        case WMI_TLV_TAG_ARRAY_STRUCT:
+                if (!swba->tim_done) {
+                        swba->tim_done = true;
+                        ret = ath10k_wmi_tlv_iter(ar, ptr, len,
+                                                  ath10k_wmi_tlv_swba_tim_parse,
+                                                  swba);
+                        if (ret)
+                                return ret;
+                } else if (!swba->noa_done) {
+                        swba->noa_done = true;
+                        ret = ath10k_wmi_tlv_iter(ar, ptr, len,
+                                                  ath10k_wmi_tlv_swba_noa_parse,
+                                                  swba);
+                        if (ret)
+                                return ret;
+                }
+                break;
+        default:
+                break;
+        }
+        return 0;
+}
+
+static int ath10k_wmi_tlv_op_pull_swba_ev(struct ath10k *ar,
+                                          struct sk_buff *skb,
+                                          struct wmi_swba_ev_arg *arg)
+{
+        struct wmi_tlv_swba_parse swba = { .arg = arg };
+        u32 map;
+        size_t n_vdevs;
+        int ret;
+
+        ret = ath10k_wmi_tlv_iter(ar, skb->data, skb->len,
+                                  ath10k_wmi_tlv_swba_parse, &swba);
+        if (ret) {
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        if (!swba.ev)
+                return -EPROTO;
+
+        arg->vdev_map = swba.ev->vdev_map;
+
+        for (map = __le32_to_cpu(arg->vdev_map), n_vdevs = 0; map; map >>= 1)
+                if (map & BIT(0))
+                        n_vdevs++;
+
+        if (n_vdevs != swba.n_tim ||
+            n_vdevs != swba.n_noa)
+                return -EPROTO;
+
+        return 0;
+}
+
+static int ath10k_wmi_tlv_op_pull_phyerr_ev(struct ath10k *ar,
+                                            struct sk_buff *skb,
+                                            struct wmi_phyerr_ev_arg *arg)
+{
+        const void **tb;
+        const struct wmi_tlv_phyerr_ev *ev;
+        const void *phyerrs;
+        int ret;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_COMB_PHYERR_RX_HDR];
+        phyerrs = tb[WMI_TLV_TAG_ARRAY_BYTE];
+
+        if (!ev || !phyerrs) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        arg->num_phyerrs  = ev->num_phyerrs;
+        arg->tsf_l32 = ev->tsf_l32;
+        arg->tsf_u32 = ev->tsf_u32;
+        arg->buf_len = ev->buf_len;
+        arg->phyerrs = phyerrs;
+
+        kfree(tb);
+        return 0;
+}
+
+#define WMI_TLV_ABI_VER_NS0 0x5F414351
+#define WMI_TLV_ABI_VER_NS1 0x00004C4D
+#define WMI_TLV_ABI_VER_NS2 0x00000000
+#define WMI_TLV_ABI_VER_NS3 0x00000000
+
+#define WMI_TLV_ABI_VER0_MAJOR 1
+#define WMI_TLV_ABI_VER0_MINOR 0
+#define WMI_TLV_ABI_VER0 ((((WMI_TLV_ABI_VER0_MAJOR) << 24) & 0xFF000000) | \
+                          (((WMI_TLV_ABI_VER0_MINOR) <<  0) & 0x00FFFFFF))
+#define WMI_TLV_ABI_VER1 53
+
+static int
+ath10k_wmi_tlv_parse_mem_reqs(struct ath10k *ar, u16 tag, u16 len,
+                              const void *ptr, void *data)
+{
+        struct wmi_svc_rdy_ev_arg *arg = data;
+        int i;
+
+        if (tag != WMI_TLV_TAG_STRUCT_WLAN_HOST_MEM_REQ)
+                return -EPROTO;
+
+        for (i = 0; i < ARRAY_SIZE(arg->mem_reqs); i++) {
+                if (!arg->mem_reqs[i]) {
+                        arg->mem_reqs[i] = ptr;
+                        return 0;
+                }
+        }
+
+        return -ENOMEM;
+}
+
+static int ath10k_wmi_tlv_op_pull_svc_rdy_ev(struct ath10k *ar,
+                                             struct sk_buff *skb,
+                                             struct wmi_svc_rdy_ev_arg *arg)
+{
+        const void **tb;
+        const struct hal_reg_capabilities *reg;
+        const struct wmi_tlv_svc_rdy_ev *ev;
+        const __le32 *svc_bmap;
+        const struct wlan_host_mem_req *mem_reqs;
+        int ret;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_SERVICE_READY_EVENT];
+        reg = tb[WMI_TLV_TAG_STRUCT_HAL_REG_CAPABILITIES];
+        svc_bmap = tb[WMI_TLV_TAG_ARRAY_UINT32];
+        mem_reqs = tb[WMI_TLV_TAG_ARRAY_STRUCT];
+
+        if (!ev || !reg || !svc_bmap || !mem_reqs) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        /* This is an internal ABI compatibility check for WMI TLV so check it
+         * here instead of the generic WMI code.
+         */
+        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                   "wmi tlv abi 0x%08x ?= 0x%08x, 0x%08x ?= 0x%08x, 0x%08x ?= 0x%08x, 0x%08x ?= 0x%08x, 0x%08x ?= 0x%08x\n",
+                   __le32_to_cpu(ev->abi.abi_ver0), WMI_TLV_ABI_VER0,
+                   __le32_to_cpu(ev->abi.abi_ver_ns0), WMI_TLV_ABI_VER_NS0,
+                   __le32_to_cpu(ev->abi.abi_ver_ns1), WMI_TLV_ABI_VER_NS1,
+                   __le32_to_cpu(ev->abi.abi_ver_ns2), WMI_TLV_ABI_VER_NS2,
+                   __le32_to_cpu(ev->abi.abi_ver_ns3), WMI_TLV_ABI_VER_NS3);
+
+        if (__le32_to_cpu(ev->abi.abi_ver0) != WMI_TLV_ABI_VER0 ||
+            __le32_to_cpu(ev->abi.abi_ver_ns0) != WMI_TLV_ABI_VER_NS0 ||
+            __le32_to_cpu(ev->abi.abi_ver_ns1) != WMI_TLV_ABI_VER_NS1 ||
+            __le32_to_cpu(ev->abi.abi_ver_ns2) != WMI_TLV_ABI_VER_NS2 ||
+            __le32_to_cpu(ev->abi.abi_ver_ns3) != WMI_TLV_ABI_VER_NS3) {
+                kfree(tb);
+                return -ENOTSUPP;
+        }
+
+        arg->min_tx_power = ev->hw_min_tx_power;
+        arg->max_tx_power = ev->hw_max_tx_power;
+        arg->ht_cap = ev->ht_cap_info;
+        arg->vht_cap = ev->vht_cap_info;
+        arg->sw_ver0 = ev->abi.abi_ver0;
+        arg->sw_ver1 = ev->abi.abi_ver1;
+        arg->fw_build = ev->fw_build_vers;
+        arg->phy_capab = ev->phy_capability;
+        arg->num_rf_chains = ev->num_rf_chains;
+        arg->eeprom_rd = reg->eeprom_rd;
+        arg->num_mem_reqs = ev->num_mem_reqs;
+        arg->service_map = svc_bmap;
+        arg->service_map_len = ath10k_wmi_tlv_len(svc_bmap);
+
+        ret = ath10k_wmi_tlv_iter(ar, mem_reqs, ath10k_wmi_tlv_len(mem_reqs),
+                                  ath10k_wmi_tlv_parse_mem_reqs, arg);
+        if (ret) {
+                kfree(tb);
+                ath10k_warn(ar, "failed to parse mem_reqs tlv: %d\n", ret);
+                return ret;
+        }
+
+        kfree(tb);
+        return 0;
+}
+
+static int ath10k_wmi_tlv_op_pull_rdy_ev(struct ath10k *ar,
+                                         struct sk_buff *skb,
+                                         struct wmi_rdy_ev_arg *arg)
+{
+        const void **tb;
+        const struct wmi_tlv_rdy_ev *ev;
+        int ret;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_READY_EVENT];
+        if (!ev) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        arg->sw_version = ev->abi.abi_ver0;
+        arg->abi_version = ev->abi.abi_ver1;
+        arg->status = ev->status;
+        arg->mac_addr = ev->mac_addr.addr;
+
+        kfree(tb);
+        return 0;
+}
+
+static int ath10k_wmi_tlv_op_pull_fw_stats(struct ath10k *ar,
+                                           struct sk_buff *skb,
+                                           struct ath10k_fw_stats *stats)
+{
+        const void **tb;
+        const struct wmi_stats_event *ev;
+        const void *data;
+        u32 num_pdev_stats, num_vdev_stats, num_peer_stats;
+        size_t data_len;
+        int ret;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_STATS_EVENT];
+        data = tb[WMI_TLV_TAG_ARRAY_BYTE];
+
+        if (!ev || !data) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        data_len = ath10k_wmi_tlv_len(data);
+        num_pdev_stats = __le32_to_cpu(ev->num_pdev_stats);
+        num_vdev_stats = __le32_to_cpu(ev->num_vdev_stats);
+        num_peer_stats = __le32_to_cpu(ev->num_peer_stats);
+
+        WARN_ON(1); /* FIXME: not implemented yet */
+
+        kfree(tb);
+        return 0;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_pdev_suspend(struct ath10k *ar, u32 opt)
+{
+        struct wmi_tlv_pdev_suspend *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PDEV_SUSPEND_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->opt = __cpu_to_le32(opt);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv pdev suspend\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_pdev_resume(struct ath10k *ar)
+{
+        struct wmi_tlv_resume_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PDEV_RESUME_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->reserved = __cpu_to_le32(0);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv pdev resume\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_pdev_set_rd(struct ath10k *ar,
+                                  u16 rd, u16 rd2g, u16 rd5g,
+                                  u16 ctl2g, u16 ctl5g,
+                                  enum wmi_dfs_region dfs_reg)
+{
+        struct wmi_tlv_pdev_set_rd_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PDEV_SET_REGDOMAIN_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->regd = __cpu_to_le32(rd);
+        cmd->regd_2ghz = __cpu_to_le32(rd2g);
+        cmd->regd_5ghz = __cpu_to_le32(rd5g);
+        cmd->conform_limit_2ghz = __cpu_to_le32(rd2g);
+        cmd->conform_limit_5ghz = __cpu_to_le32(rd5g);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv pdev set rd\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_pdev_set_param(struct ath10k *ar, u32 param_id,
+                                     u32 param_value)
+{
+        struct wmi_tlv_pdev_set_param_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PDEV_SET_PARAM_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->param_id = __cpu_to_le32(param_id);
+        cmd->param_value = __cpu_to_le32(param_value);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv pdev set param\n");
+        return skb;
+}
+
+static struct sk_buff *ath10k_wmi_tlv_op_gen_init(struct ath10k *ar)
+{
+        struct sk_buff *skb;
+        struct wmi_tlv *tlv;
+        struct wmi_tlv_init_cmd *cmd;
+        struct wmi_tlv_resource_config *cfg;
+        struct wmi_host_mem_chunks *chunks;
+        size_t len, chunks_len;
+        void *ptr;
+
+        chunks_len = ar->wmi.num_mem_chunks * sizeof(struct host_memory_chunk);
+        len = (sizeof(*tlv) + sizeof(*cmd)) +
+              (sizeof(*tlv) + sizeof(*cfg)) +
+              (sizeof(*tlv) + chunks_len);
+
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = skb->data;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_INIT_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_RESOURCE_CONFIG);
+        tlv->len = __cpu_to_le16(sizeof(*cfg));
+        cfg = (void *)tlv->value;
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cfg);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_STRUCT);
+        tlv->len = __cpu_to_le16(chunks_len);
+        chunks = (void *)tlv->value;
+
+        ptr += sizeof(*tlv);
+        ptr += chunks_len;
+
+        cmd->abi.abi_ver0 = __cpu_to_le32(WMI_TLV_ABI_VER0);
+        cmd->abi.abi_ver1 = __cpu_to_le32(WMI_TLV_ABI_VER1);
+        cmd->abi.abi_ver_ns0 = __cpu_to_le32(WMI_TLV_ABI_VER_NS0);
+        cmd->abi.abi_ver_ns1 = __cpu_to_le32(WMI_TLV_ABI_VER_NS1);
+        cmd->abi.abi_ver_ns2 = __cpu_to_le32(WMI_TLV_ABI_VER_NS2);
+        cmd->abi.abi_ver_ns3 = __cpu_to_le32(WMI_TLV_ABI_VER_NS3);
+        cmd->num_host_mem_chunks = __cpu_to_le32(ar->wmi.num_mem_chunks);
+
+        cfg->num_vdevs = __cpu_to_le32(TARGET_TLV_NUM_VDEVS);
+        cfg->num_peers = __cpu_to_le32(TARGET_TLV_NUM_PEERS);
+
+        if (test_bit(WMI_SERVICE_RX_FULL_REORDER, ar->wmi.svc_map)) {
+                cfg->num_offload_peers = __cpu_to_le32(3);
+                cfg->num_offload_reorder_bufs = __cpu_to_le32(3);
+        } else {
+                cfg->num_offload_peers = __cpu_to_le32(0);
+                cfg->num_offload_reorder_bufs = __cpu_to_le32(0);
+        }
+
+        cfg->num_peer_keys = __cpu_to_le32(2);
+        cfg->num_tids = __cpu_to_le32(TARGET_TLV_NUM_TIDS);
+        cfg->ast_skid_limit = __cpu_to_le32(0x10);
+        cfg->tx_chain_mask = __cpu_to_le32(0x7);
+        cfg->rx_chain_mask = __cpu_to_le32(0x7);
+        cfg->rx_timeout_pri[0] = __cpu_to_le32(0x64);
+        cfg->rx_timeout_pri[1] = __cpu_to_le32(0x64);
+        cfg->rx_timeout_pri[2] = __cpu_to_le32(0x64);
+        cfg->rx_timeout_pri[3] = __cpu_to_le32(0x28);
+        cfg->rx_decap_mode = __cpu_to_le32(1);
+        cfg->scan_max_pending_reqs = __cpu_to_le32(4);
+        cfg->bmiss_offload_max_vdev = __cpu_to_le32(3);
+        cfg->roam_offload_max_vdev = __cpu_to_le32(3);
+        cfg->roam_offload_max_ap_profiles = __cpu_to_le32(8);
+        cfg->num_mcast_groups = __cpu_to_le32(0);
+        cfg->num_mcast_table_elems = __cpu_to_le32(0);
+        cfg->mcast2ucast_mode = __cpu_to_le32(0);
+        cfg->tx_dbg_log_size = __cpu_to_le32(0x400);
+        cfg->num_wds_entries = __cpu_to_le32(0x20);
+        cfg->dma_burst_size = __cpu_to_le32(0);
+        cfg->mac_aggr_delim = __cpu_to_le32(0);
+        cfg->rx_skip_defrag_timeout_dup_detection_check = __cpu_to_le32(0);
+        cfg->vow_config = __cpu_to_le32(0);
+        cfg->gtk_offload_max_vdev = __cpu_to_le32(2);
+        cfg->num_msdu_desc = __cpu_to_le32(TARGET_TLV_NUM_MSDU_DESC);
+        cfg->max_frag_entries = __cpu_to_le32(2);
+        cfg->num_tdls_vdevs = __cpu_to_le32(1);
+        cfg->num_tdls_conn_table_entries = __cpu_to_le32(0x20);
+        cfg->beacon_tx_offload_max_vdev = __cpu_to_le32(2);
+        cfg->num_multicast_filter_entries = __cpu_to_le32(5);
+        cfg->num_wow_filters = __cpu_to_le32(0x16);
+        cfg->num_keep_alive_pattern = __cpu_to_le32(6);
+        cfg->keep_alive_pattern_size = __cpu_to_le32(0);
+        cfg->max_tdls_concurrent_sleep_sta = __cpu_to_le32(1);
+        cfg->max_tdls_concurrent_buffer_sta = __cpu_to_le32(1);
+
+        ath10k_wmi_put_host_mem_chunks(ar, chunks);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv init\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_start_scan(struct ath10k *ar,
+                                 const struct wmi_start_scan_arg *arg)
+{
+        struct wmi_tlv_start_scan_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        size_t len, chan_len, ssid_len, bssid_len, ie_len;
+        __le32 *chans;
+        struct wmi_ssid *ssids;
+        struct wmi_mac_addr *addrs;
+        void *ptr;
+        int i, ret;
+
+        ret = ath10k_wmi_start_scan_verify(arg);
+        if (ret)
+                return ERR_PTR(ret);
+
+        chan_len = arg->n_channels * sizeof(__le32);
+        ssid_len = arg->n_ssids * sizeof(struct wmi_ssid);
+        bssid_len = arg->n_bssids * sizeof(struct wmi_mac_addr);
+        ie_len = roundup(arg->ie_len, 4);
+        len = (sizeof(*tlv) + sizeof(*cmd)) +
+              (arg->n_channels ? sizeof(*tlv) + chan_len : 0) +
+              (arg->n_ssids ? sizeof(*tlv) + ssid_len : 0) +
+              (arg->n_bssids ? sizeof(*tlv) + bssid_len : 0) +
+              (arg->ie_len ? sizeof(*tlv) + ie_len : 0);
+
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_START_SCAN_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+
+        ath10k_wmi_put_start_scan_common(&cmd->common, arg);
+        cmd->burst_duration_ms = __cpu_to_le32(0);
+        cmd->num_channels = __cpu_to_le32(arg->n_channels);
+        cmd->num_ssids = __cpu_to_le32(arg->n_ssids);
+        cmd->num_bssids = __cpu_to_le32(arg->n_bssids);
+        cmd->ie_len = __cpu_to_le32(arg->ie_len);
+        cmd->num_probes = __cpu_to_le32(3);
+
+        /* FIXME: There are some scan flag inconsistencies across firmwares,
+         * e.g. WMI-TLV inverts the logic behind the following flag.
+         */
+        cmd->common.scan_ctrl_flags ^= __cpu_to_le32(WMI_SCAN_FILTER_PROBE_REQ);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_UINT32);
+        tlv->len = __cpu_to_le16(chan_len);
+        chans = (void *)tlv->value;
+        for (i = 0; i < arg->n_channels; i++)
+                chans[i] = __cpu_to_le32(arg->channels[i]);
+
+        ptr += sizeof(*tlv);
+        ptr += chan_len;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_FIXED_STRUCT);
+        tlv->len = __cpu_to_le16(ssid_len);
+        ssids = (void *)tlv->value;
+        for (i = 0; i < arg->n_ssids; i++) {
+                ssids[i].ssid_len = __cpu_to_le32(arg->ssids[i].len);
+                memcpy(ssids[i].ssid, arg->ssids[i].ssid, arg->ssids[i].len);
+        }
+
+        ptr += sizeof(*tlv);
+        ptr += ssid_len;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_FIXED_STRUCT);
+        tlv->len = __cpu_to_le16(bssid_len);
+        addrs = (void *)tlv->value;
+        for (i = 0; i < arg->n_bssids; i++)
+                ether_addr_copy(addrs[i].addr, arg->bssids[i].bssid);
+
+        ptr += sizeof(*tlv);
+        ptr += bssid_len;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_BYTE);
+        tlv->len = __cpu_to_le16(ie_len);
+        memcpy(tlv->value, arg->ie, arg->ie_len);
+
+        ptr += sizeof(*tlv);
+        ptr += ie_len;
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv start scan\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_stop_scan(struct ath10k *ar,
+                                const struct wmi_stop_scan_arg *arg)
+{
+        struct wmi_stop_scan_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        u32 scan_id;
+        u32 req_id;
+
+        if (arg->req_id > 0xFFF)
+                return ERR_PTR(-EINVAL);
+        if (arg->req_type == WMI_SCAN_STOP_ONE && arg->u.scan_id > 0xFFF)
+                return ERR_PTR(-EINVAL);
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        scan_id = arg->u.scan_id;
+        scan_id |= WMI_HOST_SCAN_REQ_ID_PREFIX;
+
+        req_id = arg->req_id;
+        req_id |= WMI_HOST_SCAN_REQUESTOR_ID_PREFIX;
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_STOP_SCAN_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->req_type = __cpu_to_le32(arg->req_type);
+        cmd->vdev_id = __cpu_to_le32(arg->u.vdev_id);
+        cmd->scan_id = __cpu_to_le32(scan_id);
+        cmd->scan_req_id = __cpu_to_le32(req_id);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv stop scan\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_vdev_create(struct ath10k *ar,
+                                  u32 vdev_id,
+                                  enum wmi_vdev_type vdev_type,
+                                  enum wmi_vdev_subtype vdev_subtype,
+                                  const u8 mac_addr[ETH_ALEN])
+{
+        struct wmi_vdev_create_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_VDEV_CREATE_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->vdev_type = __cpu_to_le32(vdev_type);
+        cmd->vdev_subtype = __cpu_to_le32(vdev_subtype);
+        ether_addr_copy(cmd->vdev_macaddr.addr, mac_addr);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv vdev create\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_vdev_delete(struct ath10k *ar, u32 vdev_id)
+{
+        struct wmi_vdev_delete_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_VDEV_DELETE_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv vdev delete\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_vdev_start(struct ath10k *ar,
+                                 const struct wmi_vdev_start_request_arg *arg,
+                                 bool restart)
+{
+        struct wmi_tlv_vdev_start_cmd *cmd;
+        struct wmi_channel *ch;
+        struct wmi_p2p_noa_descriptor *noa;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        size_t len;
+        void *ptr;
+        u32 flags = 0;
+
+        if (WARN_ON(arg->ssid && arg->ssid_len == 0))
+                return ERR_PTR(-EINVAL);
+        if (WARN_ON(arg->hidden_ssid && !arg->ssid))
+                return ERR_PTR(-EINVAL);
+        if (WARN_ON(arg->ssid_len > sizeof(cmd->ssid.ssid)))
+                return ERR_PTR(-EINVAL);
+
+        len = (sizeof(*tlv) + sizeof(*cmd)) +
+              (sizeof(*tlv) + sizeof(*ch)) +
+              (sizeof(*tlv) + 0);
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        if (arg->hidden_ssid)
+                flags |= WMI_VDEV_START_HIDDEN_SSID;
+        if (arg->pmf_enabled)
+                flags |= WMI_VDEV_START_PMF_ENABLED;
+
+        ptr = (void *)skb->data;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_VDEV_START_REQUEST_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(arg->vdev_id);
+        cmd->bcn_intval = __cpu_to_le32(arg->bcn_intval);
+        cmd->dtim_period = __cpu_to_le32(arg->dtim_period);
+        cmd->flags = __cpu_to_le32(flags);
+        cmd->bcn_tx_rate = __cpu_to_le32(arg->bcn_tx_rate);
+        cmd->bcn_tx_power = __cpu_to_le32(arg->bcn_tx_power);
+        cmd->disable_hw_ack = __cpu_to_le32(arg->disable_hw_ack);
+
+        if (arg->ssid) {
+                cmd->ssid.ssid_len = __cpu_to_le32(arg->ssid_len);
+                memcpy(cmd->ssid.ssid, arg->ssid, arg->ssid_len);
+        }
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_CHANNEL);
+        tlv->len = __cpu_to_le16(sizeof(*ch));
+        ch = (void *)tlv->value;
+        ath10k_wmi_put_wmi_channel(ch, &arg->channel);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*ch);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_STRUCT);
+        tlv->len = 0;
+        noa = (void *)tlv->value;
+
+        /* Note: This is a nested TLV containing:
+         * [wmi_tlv][wmi_p2p_noa_descriptor][wmi_tlv]..
+         */
+
+        ptr += sizeof(*tlv);
+        ptr += 0;
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv vdev start\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_vdev_stop(struct ath10k *ar, u32 vdev_id)
+{
+        struct wmi_vdev_stop_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_VDEV_STOP_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv vdev stop\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_vdev_up(struct ath10k *ar, u32 vdev_id, u32 aid,
+                              const u8 *bssid)
+
+{
+        struct wmi_vdev_up_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_VDEV_UP_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->vdev_assoc_id = __cpu_to_le32(aid);
+        ether_addr_copy(cmd->vdev_bssid.addr, bssid);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv vdev up\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_vdev_down(struct ath10k *ar, u32 vdev_id)
+{
+        struct wmi_vdev_down_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_VDEV_DOWN_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv vdev down\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_vdev_set_param(struct ath10k *ar, u32 vdev_id,
+                                     u32 param_id, u32 param_value)
+{
+        struct wmi_vdev_set_param_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_VDEV_SET_PARAM_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->param_id = __cpu_to_le32(param_id);
+        cmd->param_value = __cpu_to_le32(param_value);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv vdev set param\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_vdev_install_key(struct ath10k *ar,
+                                       const struct wmi_vdev_install_key_arg *arg)
+{
+        struct wmi_vdev_install_key_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        size_t len;
+        void *ptr;
+
+        if (arg->key_cipher == WMI_CIPHER_NONE && arg->key_data != NULL)
+                return ERR_PTR(-EINVAL);
+        if (arg->key_cipher != WMI_CIPHER_NONE && arg->key_data == NULL)
+                return ERR_PTR(-EINVAL);
+
+        len = sizeof(*tlv) + sizeof(*cmd) +
+              sizeof(*tlv) + roundup(arg->key_len, sizeof(__le32));
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_VDEV_INSTALL_KEY_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(arg->vdev_id);
+        cmd->key_idx = __cpu_to_le32(arg->key_idx);
+        cmd->key_flags = __cpu_to_le32(arg->key_flags);
+        cmd->key_cipher = __cpu_to_le32(arg->key_cipher);
+        cmd->key_len = __cpu_to_le32(arg->key_len);
+        cmd->key_txmic_len = __cpu_to_le32(arg->key_txmic_len);
+        cmd->key_rxmic_len = __cpu_to_le32(arg->key_rxmic_len);
+
+        if (arg->macaddr)
+                ether_addr_copy(cmd->peer_macaddr.addr, arg->macaddr);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_BYTE);
+        tlv->len = __cpu_to_le16(roundup(arg->key_len, sizeof(__le32)));
+        if (arg->key_data)
+                memcpy(tlv->value, arg->key_data, arg->key_len);
+
+        ptr += sizeof(*tlv);
+        ptr += roundup(arg->key_len, sizeof(__le32));
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv vdev install key\n");
+        return skb;
+}
+
+static void *ath10k_wmi_tlv_put_uapsd_ac(struct ath10k *ar, void *ptr,
+                                         const struct wmi_sta_uapsd_auto_trig_arg *arg)
+{
+        struct wmi_sta_uapsd_auto_trig_param *ac;
+        struct wmi_tlv *tlv;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_STA_UAPSD_AUTO_TRIG_PARAM);
+        tlv->len = __cpu_to_le16(sizeof(*ac));
+        ac = (void *)tlv->value;
+
+        ac->wmm_ac = __cpu_to_le32(arg->wmm_ac);
+        ac->user_priority = __cpu_to_le32(arg->user_priority);
+        ac->service_interval = __cpu_to_le32(arg->service_interval);
+        ac->suspend_interval = __cpu_to_le32(arg->suspend_interval);
+        ac->delay_interval = __cpu_to_le32(arg->delay_interval);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                   "wmi tlv vdev sta uapsd auto trigger ac %d prio %d svc int %d susp int %d delay int %d\n",
+                   ac->wmm_ac, ac->user_priority, ac->service_interval,
+                   ac->suspend_interval, ac->delay_interval);
+
+        return ptr + sizeof(*tlv) + sizeof(*ac);
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_vdev_sta_uapsd(struct ath10k *ar, u32 vdev_id,
+                                     const u8 peer_addr[ETH_ALEN],
+                                     const struct wmi_sta_uapsd_auto_trig_arg *args,
+                                     u32 num_ac)
+{
+        struct wmi_sta_uapsd_auto_trig_cmd_fixed_param *cmd;
+        struct wmi_sta_uapsd_auto_trig_param *ac;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        size_t len;
+        size_t ac_tlv_len;
+        void *ptr;
+        int i;
+
+        ac_tlv_len = num_ac * (sizeof(*tlv) + sizeof(*ac));
+        len = sizeof(*tlv) + sizeof(*cmd) +
+              sizeof(*tlv) + ac_tlv_len;
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_STA_UAPSD_AUTO_TRIG_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->num_ac = __cpu_to_le32(num_ac);
+        ether_addr_copy(cmd->peer_macaddr.addr, peer_addr);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_STRUCT);
+        tlv->len = __cpu_to_le16(ac_tlv_len);
+        ac = (void *)tlv->value;
+
+        ptr += sizeof(*tlv);
+        for (i = 0; i < num_ac; i++)
+                ptr = ath10k_wmi_tlv_put_uapsd_ac(ar, ptr, &args[i]);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv vdev sta uapsd auto trigger\n");
+        return skb;
+}
+
+static void *ath10k_wmi_tlv_put_wmm(void *ptr,
+                                    const struct wmi_wmm_params_arg *arg)
+{
+        struct wmi_wmm_params *wmm;
+        struct wmi_tlv *tlv;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_WMM_PARAMS);
+        tlv->len = __cpu_to_le16(sizeof(*wmm));
+        wmm = (void *)tlv->value;
+        ath10k_wmi_set_wmm_param(wmm, arg);
+
+        return ptr + sizeof(*tlv) + sizeof(*wmm);
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_vdev_wmm_conf(struct ath10k *ar, u32 vdev_id,
+                                    const struct wmi_wmm_params_all_arg *arg)
+{
+        struct wmi_tlv_vdev_set_wmm_cmd *cmd;
+        struct wmi_wmm_params *wmm;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        size_t len;
+        void *ptr;
+
+        len = (sizeof(*tlv) + sizeof(*cmd)) +
+              (4 * (sizeof(*tlv) + sizeof(*wmm)));
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_VDEV_SET_WMM_PARAMS_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        ptr = ath10k_wmi_tlv_put_wmm(ptr, &arg->ac_be);
+        ptr = ath10k_wmi_tlv_put_wmm(ptr, &arg->ac_bk);
+        ptr = ath10k_wmi_tlv_put_wmm(ptr, &arg->ac_vi);
+        ptr = ath10k_wmi_tlv_put_wmm(ptr, &arg->ac_vo);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv vdev wmm conf\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_sta_keepalive(struct ath10k *ar,
+                                    const struct wmi_sta_keepalive_arg *arg)
+{
+        struct wmi_tlv_sta_keepalive_cmd *cmd;
+        struct wmi_sta_keepalive_arp_resp *arp;
+        struct sk_buff *skb;
+        struct wmi_tlv *tlv;
+        void *ptr;
+        size_t len;
+
+        len = sizeof(*tlv) + sizeof(*cmd) +
+              sizeof(*tlv) + sizeof(*arp);
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_STA_KEEPALIVE_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(arg->vdev_id);
+        cmd->enabled = __cpu_to_le32(arg->enabled);
+        cmd->method = __cpu_to_le32(arg->method);
+        cmd->interval = __cpu_to_le32(arg->interval);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_STA_KEEPALVE_ARP_RESPONSE);
+        tlv->len = __cpu_to_le16(sizeof(*arp));
+        arp = (void *)tlv->value;
+
+        arp->src_ip4_addr = arg->src_ip4_addr;
+        arp->dest_ip4_addr = arg->dest_ip4_addr;
+        ether_addr_copy(arp->dest_mac_addr.addr, arg->dest_mac_addr);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv sta keepalive vdev %d enabled %d method %d inverval %d\n",
+                   arg->vdev_id, arg->enabled, arg->method, arg->interval);
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_peer_create(struct ath10k *ar, u32 vdev_id,
+                                  const u8 peer_addr[ETH_ALEN])
+{
+        struct wmi_tlv_peer_create_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PEER_CREATE_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->peer_type = __cpu_to_le32(WMI_TLV_PEER_TYPE_DEFAULT); /* FIXME */
+        ether_addr_copy(cmd->peer_addr.addr, peer_addr);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv peer create\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_peer_delete(struct ath10k *ar, u32 vdev_id,
+                                  const u8 peer_addr[ETH_ALEN])
+{
+        struct wmi_peer_delete_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PEER_DELETE_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        ether_addr_copy(cmd->peer_macaddr.addr, peer_addr);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv peer delete\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_peer_flush(struct ath10k *ar, u32 vdev_id,
+                                 const u8 peer_addr[ETH_ALEN], u32 tid_bitmap)
+{
+        struct wmi_peer_flush_tids_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PEER_FLUSH_TIDS_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->peer_tid_bitmap = __cpu_to_le32(tid_bitmap);
+        ether_addr_copy(cmd->peer_macaddr.addr, peer_addr);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv peer flush\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_peer_set_param(struct ath10k *ar, u32 vdev_id,
+                                     const u8 *peer_addr,
+                                     enum wmi_peer_param param_id,
+                                     u32 param_value)
+{
+        struct wmi_peer_set_param_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PEER_SET_PARAM_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->param_id = __cpu_to_le32(param_id);
+        cmd->param_value = __cpu_to_le32(param_value);
+        ether_addr_copy(cmd->peer_macaddr.addr, peer_addr);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv peer set param\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_peer_assoc(struct ath10k *ar,
+                                 const struct wmi_peer_assoc_complete_arg *arg)
+{
+        struct wmi_tlv_peer_assoc_cmd *cmd;
+        struct wmi_vht_rate_set *vht_rate;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        size_t len, legacy_rate_len, ht_rate_len;
+        void *ptr;
+
+        if (arg->peer_mpdu_density > 16)
+                return ERR_PTR(-EINVAL);
+        if (arg->peer_legacy_rates.num_rates > MAX_SUPPORTED_RATES)
+                return ERR_PTR(-EINVAL);
+        if (arg->peer_ht_rates.num_rates > MAX_SUPPORTED_RATES)
+                return ERR_PTR(-EINVAL);
+
+        legacy_rate_len = roundup(arg->peer_legacy_rates.num_rates,
+                                  sizeof(__le32));
+        ht_rate_len = roundup(arg->peer_ht_rates.num_rates, sizeof(__le32));
+        len = (sizeof(*tlv) + sizeof(*cmd)) +
+              (sizeof(*tlv) + legacy_rate_len) +
+              (sizeof(*tlv) + ht_rate_len) +
+              (sizeof(*tlv) + sizeof(*vht_rate));
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PEER_ASSOC_COMPLETE_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+
+        cmd->vdev_id = __cpu_to_le32(arg->vdev_id);
+        cmd->new_assoc = __cpu_to_le32(arg->peer_reassoc ? 0 : 1);
+        cmd->assoc_id = __cpu_to_le32(arg->peer_aid);
+        cmd->flags = __cpu_to_le32(arg->peer_flags);
+        cmd->caps = __cpu_to_le32(arg->peer_caps);
+        cmd->listen_intval = __cpu_to_le32(arg->peer_listen_intval);
+        cmd->ht_caps = __cpu_to_le32(arg->peer_ht_caps);
+        cmd->max_mpdu = __cpu_to_le32(arg->peer_max_mpdu);
+        cmd->mpdu_density = __cpu_to_le32(arg->peer_mpdu_density);
+        cmd->rate_caps = __cpu_to_le32(arg->peer_rate_caps);
+        cmd->nss = __cpu_to_le32(arg->peer_num_spatial_streams);
+        cmd->vht_caps = __cpu_to_le32(arg->peer_vht_caps);
+        cmd->phy_mode = __cpu_to_le32(arg->peer_phymode);
+        cmd->num_legacy_rates = __cpu_to_le32(arg->peer_legacy_rates.num_rates);
+        cmd->num_ht_rates = __cpu_to_le32(arg->peer_ht_rates.num_rates);
+        ether_addr_copy(cmd->mac_addr.addr, arg->addr);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_BYTE);
+        tlv->len = __cpu_to_le16(legacy_rate_len);
+        memcpy(tlv->value, arg->peer_legacy_rates.rates,
+               arg->peer_legacy_rates.num_rates);
+
+        ptr += sizeof(*tlv);
+        ptr += legacy_rate_len;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_BYTE);
+        tlv->len = __cpu_to_le16(ht_rate_len);
+        memcpy(tlv->value, arg->peer_ht_rates.rates,
+               arg->peer_ht_rates.num_rates);
+
+        ptr += sizeof(*tlv);
+        ptr += ht_rate_len;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_VHT_RATE_SET);
+        tlv->len = __cpu_to_le16(sizeof(*vht_rate));
+        vht_rate = (void *)tlv->value;
+
+        vht_rate->rx_max_rate = __cpu_to_le32(arg->peer_vht_rates.rx_max_rate);
+        vht_rate->rx_mcs_set = __cpu_to_le32(arg->peer_vht_rates.rx_mcs_set);
+        vht_rate->tx_max_rate = __cpu_to_le32(arg->peer_vht_rates.tx_max_rate);
+        vht_rate->tx_mcs_set = __cpu_to_le32(arg->peer_vht_rates.tx_mcs_set);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*vht_rate);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv peer assoc\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_set_psmode(struct ath10k *ar, u32 vdev_id,
+                                 enum wmi_sta_ps_mode psmode)
+{
+        struct wmi_sta_powersave_mode_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_STA_POWERSAVE_MODE_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->sta_ps_mode = __cpu_to_le32(psmode);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv set psmode\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_set_sta_ps(struct ath10k *ar, u32 vdev_id,
+                                 enum wmi_sta_powersave_param param_id,
+                                 u32 param_value)
+{
+        struct wmi_sta_powersave_param_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_STA_POWERSAVE_PARAM_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->param_id = __cpu_to_le32(param_id);
+        cmd->param_value = __cpu_to_le32(param_value);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv set sta ps\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_set_ap_ps(struct ath10k *ar, u32 vdev_id, const u8 *mac,
+                                enum wmi_ap_ps_peer_param param_id, u32 value)
+{
+        struct wmi_ap_ps_peer_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        if (!mac)
+                return ERR_PTR(-EINVAL);
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_AP_PS_PEER_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->param_id = __cpu_to_le32(param_id);
+        cmd->param_value = __cpu_to_le32(value);
+        ether_addr_copy(cmd->peer_macaddr.addr, mac);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv ap ps param\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_scan_chan_list(struct ath10k *ar,
+                                     const struct wmi_scan_chan_list_arg *arg)
+{
+        struct wmi_tlv_scan_chan_list_cmd *cmd;
+        struct wmi_channel *ci;
+        struct wmi_channel_arg *ch;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        size_t chans_len, len;
+        int i;
+        void *ptr, *chans;
+
+        chans_len = arg->n_channels * (sizeof(*tlv) + sizeof(*ci));
+        len = (sizeof(*tlv) + sizeof(*cmd)) +
+              (sizeof(*tlv) + chans_len);
+
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_SCAN_CHAN_LIST_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->num_scan_chans = __cpu_to_le32(arg->n_channels);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_STRUCT);
+        tlv->len = __cpu_to_le16(chans_len);
+        chans = (void *)tlv->value;
+
+        for (i = 0; i < arg->n_channels; i++) {
+                ch = &arg->channels[i];
+
+                tlv = chans;
+                tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_CHANNEL);
+                tlv->len = __cpu_to_le16(sizeof(*ci));
+                ci = (void *)tlv->value;
+
+                ath10k_wmi_put_wmi_channel(ci, ch);
+
+                chans += sizeof(*tlv);
+                chans += sizeof(*ci);
+        }
+
+        ptr += sizeof(*tlv);
+        ptr += chans_len;
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv scan chan list\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_beacon_dma(struct ath10k *ar, u32 vdev_id,
+                                 const void *bcn, size_t bcn_len,
+                                 u32 bcn_paddr, bool dtim_zero,
+                                 bool deliver_cab)
+
+{
+        struct wmi_bcn_tx_ref_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        struct ieee80211_hdr *hdr;
+        u16 fc;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        hdr = (struct ieee80211_hdr *)bcn;
+        fc = le16_to_cpu(hdr->frame_control);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_BCN_SEND_FROM_HOST_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->data_len = __cpu_to_le32(bcn_len);
+        cmd->data_ptr = __cpu_to_le32(bcn_paddr);
+        cmd->msdu_id = 0;
+        cmd->frame_control = __cpu_to_le32(fc);
+        cmd->flags = 0;
+
+        if (dtim_zero)
+                cmd->flags |= __cpu_to_le32(WMI_BCN_TX_REF_FLAG_DTIM_ZERO);
+
+        if (deliver_cab)
+                cmd->flags |= __cpu_to_le32(WMI_BCN_TX_REF_FLAG_DELIVER_CAB);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv beacon dma\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_pdev_set_wmm(struct ath10k *ar,
+                                   const struct wmi_wmm_params_all_arg *arg)
+{
+        struct wmi_tlv_pdev_set_wmm_cmd *cmd;
+        struct wmi_wmm_params *wmm;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        size_t len;
+        void *ptr;
+
+        len = (sizeof(*tlv) + sizeof(*cmd)) +
+              (4 * (sizeof(*tlv) + sizeof(*wmm)));
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PDEV_SET_WMM_PARAMS_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+
+        /* nothing to set here */
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        ptr = ath10k_wmi_tlv_put_wmm(ptr, &arg->ac_be);
+        ptr = ath10k_wmi_tlv_put_wmm(ptr, &arg->ac_bk);
+        ptr = ath10k_wmi_tlv_put_wmm(ptr, &arg->ac_vi);
+        ptr = ath10k_wmi_tlv_put_wmm(ptr, &arg->ac_vo);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv pdev set wmm\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_request_stats(struct ath10k *ar,
+                                    enum wmi_stats_id stats_id)
+{
+        struct wmi_request_stats_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_REQUEST_STATS_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->stats_id = __cpu_to_le32(stats_id);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv request stats\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_force_fw_hang(struct ath10k *ar,
+                                    enum wmi_force_fw_hang_type type,
+                                    u32 delay_ms)
+{
+        struct wmi_force_fw_hang_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_FORCE_FW_HANG_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->type = __cpu_to_le32(type);
+        cmd->delay_ms = __cpu_to_le32(delay_ms);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv force fw hang\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_dbglog_cfg(struct ath10k *ar, u32 module_enable,
+                                 u32 log_level) {
+        struct wmi_tlv_dbglog_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        size_t len, bmap_len;
+        u32 value;
+        void *ptr;
+
+        if (module_enable) {
+                value = WMI_TLV_DBGLOG_LOG_LEVEL_VALUE(
+                                module_enable,
+                                WMI_TLV_DBGLOG_LOG_LEVEL_VERBOSE);
+        } else {
+                value = WMI_TLV_DBGLOG_LOG_LEVEL_VALUE(
+                                WMI_TLV_DBGLOG_ALL_MODULES,
+                                WMI_TLV_DBGLOG_LOG_LEVEL_WARN);
+        }
+
+        bmap_len = 0;
+        len = sizeof(*tlv) + sizeof(*cmd) + sizeof(*tlv) + bmap_len;
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_DEBUG_LOG_CONFIG_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->param = __cpu_to_le32(WMI_TLV_DBGLOG_PARAM_LOG_LEVEL);
+        cmd->value = __cpu_to_le32(value);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_UINT32);
+        tlv->len = __cpu_to_le16(bmap_len);
+
+        /* nothing to do here */
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(bmap_len);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv dbglog value 0x%08x\n", value);
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_pktlog_enable(struct ath10k *ar, u32 filter)
+{
+        struct wmi_tlv_pktlog_enable *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        void *ptr;
+        size_t len;
+
+        len = sizeof(*tlv) + sizeof(*cmd);
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PDEV_PKTLOG_ENABLE_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->filter = __cpu_to_le32(filter);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv pktlog enable filter 0x%08x\n",
+                   filter);
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_pktlog_disable(struct ath10k *ar)
+{
+        struct wmi_tlv_pktlog_disable *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        void *ptr;
+        size_t len;
+
+        len = sizeof(*tlv) + sizeof(*cmd);
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PDEV_PKTLOG_DISABLE_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv pktlog disable\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_bcn_tmpl(struct ath10k *ar, u32 vdev_id,
+                               u32 tim_ie_offset, struct sk_buff *bcn,
+                               u32 prb_caps, u32 prb_erp, void *prb_ies,
+                               size_t prb_ies_len)
+{
+        struct wmi_tlv_bcn_tmpl_cmd *cmd;
+        struct wmi_tlv_bcn_prb_info *info;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        void *ptr;
+        size_t len;
+
+        if (WARN_ON(prb_ies_len > 0 && !prb_ies))
+                return ERR_PTR(-EINVAL);
+
+        len = sizeof(*tlv) + sizeof(*cmd) +
+              sizeof(*tlv) + sizeof(*info) + prb_ies_len +
+              sizeof(*tlv) + roundup(bcn->len, 4);
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_BCN_TMPL_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->tim_ie_offset = __cpu_to_le32(tim_ie_offset);
+        cmd->buf_len = __cpu_to_le32(bcn->len);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        /* FIXME: prb_ies_len should be probably aligned to 4byte boundary but
+         * then it is then impossible to pass original ie len.
+         * This chunk is not used yet so if setting probe resp template yields
+         * problems with beaconing or crashes firmware look here.
+         */
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_BCN_PRB_INFO);
+        tlv->len = __cpu_to_le16(sizeof(*info) + prb_ies_len);
+        info = (void *)tlv->value;
+        info->caps = __cpu_to_le32(prb_caps);
+        info->erp = __cpu_to_le32(prb_erp);
+        memcpy(info->ies, prb_ies, prb_ies_len);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*info);
+        ptr += prb_ies_len;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_BYTE);
+        tlv->len = __cpu_to_le16(roundup(bcn->len, 4));
+        memcpy(tlv->value, bcn->data, bcn->len);
+
+        /* FIXME: Adjust TSF? */
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv bcn tmpl vdev_id %i\n",
+                   vdev_id);
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_prb_tmpl(struct ath10k *ar, u32 vdev_id,
+                               struct sk_buff *prb)
+{
+        struct wmi_tlv_prb_tmpl_cmd *cmd;
+        struct wmi_tlv_bcn_prb_info *info;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        void *ptr;
+        size_t len;
+
+        len = sizeof(*tlv) + sizeof(*cmd) +
+              sizeof(*tlv) + sizeof(*info) +
+              sizeof(*tlv) + roundup(prb->len, 4);
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PRB_TMPL_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->buf_len = __cpu_to_le32(prb->len);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_BCN_PRB_INFO);
+        tlv->len = __cpu_to_le16(sizeof(*info));
+        info = (void *)tlv->value;
+        info->caps = 0;
+        info->erp = 0;
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*info);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_BYTE);
+        tlv->len = __cpu_to_le16(roundup(prb->len, 4));
+        memcpy(tlv->value, prb->data, prb->len);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv prb tmpl vdev_id %i\n",
+                   vdev_id);
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_p2p_go_bcn_ie(struct ath10k *ar, u32 vdev_id,
+                                    const u8 *p2p_ie)
+{
+        struct wmi_tlv_p2p_go_bcn_ie *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        void *ptr;
+        size_t len;
+
+        len = sizeof(*tlv) + sizeof(*cmd) +
+              sizeof(*tlv) + roundup(p2p_ie[1] + 2, 4);
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_P2P_GO_SET_BEACON_IE);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->ie_len = __cpu_to_le32(p2p_ie[1] + 2);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_BYTE);
+        tlv->len = __cpu_to_le16(roundup(p2p_ie[1] + 2, 4));
+        memcpy(tlv->value, p2p_ie, p2p_ie[1] + 2);
+
+        ptr += sizeof(*tlv);
+        ptr += roundup(p2p_ie[1] + 2, 4);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv p2p go bcn ie for vdev %i\n",
+                   vdev_id);
+        return skb;
+}
+
+/****************/
+/* TLV mappings */
+/****************/
+
+static struct wmi_cmd_map wmi_tlv_cmd_map = {
+        .init_cmdid = WMI_TLV_INIT_CMDID,
+        .start_scan_cmdid = WMI_TLV_START_SCAN_CMDID,
+        .stop_scan_cmdid = WMI_TLV_STOP_SCAN_CMDID,
+        .scan_chan_list_cmdid = WMI_TLV_SCAN_CHAN_LIST_CMDID,
+        .scan_sch_prio_tbl_cmdid = WMI_TLV_SCAN_SCH_PRIO_TBL_CMDID,
+        .pdev_set_regdomain_cmdid = WMI_TLV_PDEV_SET_REGDOMAIN_CMDID,
+        .pdev_set_channel_cmdid = WMI_TLV_PDEV_SET_CHANNEL_CMDID,
+        .pdev_set_param_cmdid = WMI_TLV_PDEV_SET_PARAM_CMDID,
+        .pdev_pktlog_enable_cmdid = WMI_TLV_PDEV_PKTLOG_ENABLE_CMDID,
+        .pdev_pktlog_disable_cmdid = WMI_TLV_PDEV_PKTLOG_DISABLE_CMDID,
+        .pdev_set_wmm_params_cmdid = WMI_TLV_PDEV_SET_WMM_PARAMS_CMDID,
+        .pdev_set_ht_cap_ie_cmdid = WMI_TLV_PDEV_SET_HT_CAP_IE_CMDID,
+        .pdev_set_vht_cap_ie_cmdid = WMI_TLV_PDEV_SET_VHT_CAP_IE_CMDID,
+        .pdev_set_dscp_tid_map_cmdid = WMI_TLV_PDEV_SET_DSCP_TID_MAP_CMDID,
+        .pdev_set_quiet_mode_cmdid = WMI_TLV_PDEV_SET_QUIET_MODE_CMDID,
+        .pdev_green_ap_ps_enable_cmdid = WMI_TLV_PDEV_GREEN_AP_PS_ENABLE_CMDID,
+        .pdev_get_tpc_config_cmdid = WMI_TLV_PDEV_GET_TPC_CONFIG_CMDID,
+        .pdev_set_base_macaddr_cmdid = WMI_TLV_PDEV_SET_BASE_MACADDR_CMDID,
+        .vdev_create_cmdid = WMI_TLV_VDEV_CREATE_CMDID,
+        .vdev_delete_cmdid = WMI_TLV_VDEV_DELETE_CMDID,
+        .vdev_start_request_cmdid = WMI_TLV_VDEV_START_REQUEST_CMDID,
+        .vdev_restart_request_cmdid = WMI_TLV_VDEV_RESTART_REQUEST_CMDID,
+        .vdev_up_cmdid = WMI_TLV_VDEV_UP_CMDID,
+        .vdev_stop_cmdid = WMI_TLV_VDEV_STOP_CMDID,
+        .vdev_down_cmdid = WMI_TLV_VDEV_DOWN_CMDID,
+        .vdev_set_param_cmdid = WMI_TLV_VDEV_SET_PARAM_CMDID,
+        .vdev_install_key_cmdid = WMI_TLV_VDEV_INSTALL_KEY_CMDID,
+        .peer_create_cmdid = WMI_TLV_PEER_CREATE_CMDID,
+        .peer_delete_cmdid = WMI_TLV_PEER_DELETE_CMDID,
+        .peer_flush_tids_cmdid = WMI_TLV_PEER_FLUSH_TIDS_CMDID,
+        .peer_set_param_cmdid = WMI_TLV_PEER_SET_PARAM_CMDID,
+        .peer_assoc_cmdid = WMI_TLV_PEER_ASSOC_CMDID,
+        .peer_add_wds_entry_cmdid = WMI_TLV_PEER_ADD_WDS_ENTRY_CMDID,
+        .peer_remove_wds_entry_cmdid = WMI_TLV_PEER_REMOVE_WDS_ENTRY_CMDID,
+        .peer_mcast_group_cmdid = WMI_TLV_PEER_MCAST_GROUP_CMDID,
+        .bcn_tx_cmdid = WMI_TLV_BCN_TX_CMDID,
+        .pdev_send_bcn_cmdid = WMI_TLV_PDEV_SEND_BCN_CMDID,
+        .bcn_tmpl_cmdid = WMI_TLV_BCN_TMPL_CMDID,
+        .bcn_filter_rx_cmdid = WMI_TLV_BCN_FILTER_RX_CMDID,
+        .prb_req_filter_rx_cmdid = WMI_TLV_PRB_REQ_FILTER_RX_CMDID,
+        .mgmt_tx_cmdid = WMI_TLV_MGMT_TX_CMDID,
+        .prb_tmpl_cmdid = WMI_TLV_PRB_TMPL_CMDID,
+        .addba_clear_resp_cmdid = WMI_TLV_ADDBA_CLEAR_RESP_CMDID,
+        .addba_send_cmdid = WMI_TLV_ADDBA_SEND_CMDID,
+        .addba_status_cmdid = WMI_TLV_ADDBA_STATUS_CMDID,
+        .delba_send_cmdid = WMI_TLV_DELBA_SEND_CMDID,
+        .addba_set_resp_cmdid = WMI_TLV_ADDBA_SET_RESP_CMDID,
+        .send_singleamsdu_cmdid = WMI_TLV_SEND_SINGLEAMSDU_CMDID,
+        .sta_powersave_mode_cmdid = WMI_TLV_STA_POWERSAVE_MODE_CMDID,
+        .sta_powersave_param_cmdid = WMI_TLV_STA_POWERSAVE_PARAM_CMDID,
+        .sta_mimo_ps_mode_cmdid = WMI_TLV_STA_MIMO_PS_MODE_CMDID,
+        .pdev_dfs_enable_cmdid = WMI_TLV_PDEV_DFS_ENABLE_CMDID,
+        .pdev_dfs_disable_cmdid = WMI_TLV_PDEV_DFS_DISABLE_CMDID,
+        .roam_scan_mode = WMI_TLV_ROAM_SCAN_MODE,
+        .roam_scan_rssi_threshold = WMI_TLV_ROAM_SCAN_RSSI_THRESHOLD,
+        .roam_scan_period = WMI_TLV_ROAM_SCAN_PERIOD,
+        .roam_scan_rssi_change_threshold =
+                                WMI_TLV_ROAM_SCAN_RSSI_CHANGE_THRESHOLD,
+        .roam_ap_profile = WMI_TLV_ROAM_AP_PROFILE,
+        .ofl_scan_add_ap_profile = WMI_TLV_ROAM_AP_PROFILE,
+        .ofl_scan_remove_ap_profile = WMI_TLV_OFL_SCAN_REMOVE_AP_PROFILE,
+        .ofl_scan_period = WMI_TLV_OFL_SCAN_PERIOD,
+        .p2p_dev_set_device_info = WMI_TLV_P2P_DEV_SET_DEVICE_INFO,
+        .p2p_dev_set_discoverability = WMI_TLV_P2P_DEV_SET_DISCOVERABILITY,
+        .p2p_go_set_beacon_ie = WMI_TLV_P2P_GO_SET_BEACON_IE,
+        .p2p_go_set_probe_resp_ie = WMI_TLV_P2P_GO_SET_PROBE_RESP_IE,
+        .p2p_set_vendor_ie_data_cmdid = WMI_TLV_P2P_SET_VENDOR_IE_DATA_CMDID,
+        .ap_ps_peer_param_cmdid = WMI_TLV_AP_PS_PEER_PARAM_CMDID,
+        .ap_ps_peer_uapsd_coex_cmdid = WMI_TLV_AP_PS_PEER_UAPSD_COEX_CMDID,
+        .peer_rate_retry_sched_cmdid = WMI_TLV_PEER_RATE_RETRY_SCHED_CMDID,
+        .wlan_profile_trigger_cmdid = WMI_TLV_WLAN_PROFILE_TRIGGER_CMDID,
+        .wlan_profile_set_hist_intvl_cmdid =
+                                WMI_TLV_WLAN_PROFILE_SET_HIST_INTVL_CMDID,
+        .wlan_profile_get_profile_data_cmdid =
+                                WMI_TLV_WLAN_PROFILE_GET_PROFILE_DATA_CMDID,
+        .wlan_profile_enable_profile_id_cmdid =
+                                WMI_TLV_WLAN_PROFILE_ENABLE_PROFILE_ID_CMDID,
+        .wlan_profile_list_profile_id_cmdid =
+                                WMI_TLV_WLAN_PROFILE_LIST_PROFILE_ID_CMDID,
+        .pdev_suspend_cmdid = WMI_TLV_PDEV_SUSPEND_CMDID,
+        .pdev_resume_cmdid = WMI_TLV_PDEV_RESUME_CMDID,
+        .add_bcn_filter_cmdid = WMI_TLV_ADD_BCN_FILTER_CMDID,
+        .rmv_bcn_filter_cmdid = WMI_TLV_RMV_BCN_FILTER_CMDID,
+        .wow_add_wake_pattern_cmdid = WMI_TLV_WOW_ADD_WAKE_PATTERN_CMDID,
+        .wow_del_wake_pattern_cmdid = WMI_TLV_WOW_DEL_WAKE_PATTERN_CMDID,
+        .wow_enable_disable_wake_event_cmdid =
+                                WMI_TLV_WOW_ENABLE_DISABLE_WAKE_EVENT_CMDID,
+        .wow_enable_cmdid = WMI_TLV_WOW_ENABLE_CMDID,
+        .wow_hostwakeup_from_sleep_cmdid =
+                                WMI_TLV_WOW_HOSTWAKEUP_FROM_SLEEP_CMDID,
+        .rtt_measreq_cmdid = WMI_TLV_RTT_MEASREQ_CMDID,
+        .rtt_tsf_cmdid = WMI_TLV_RTT_TSF_CMDID,
+        .vdev_spectral_scan_configure_cmdid = WMI_TLV_SPECTRAL_SCAN_CONF_CMDID,
+        .vdev_spectral_scan_enable_cmdid = WMI_TLV_SPECTRAL_SCAN_ENABLE_CMDID,
+        .request_stats_cmdid = WMI_TLV_REQUEST_STATS_CMDID,
+        .set_arp_ns_offload_cmdid = WMI_TLV_SET_ARP_NS_OFFLOAD_CMDID,
+        .network_list_offload_config_cmdid =
+                                WMI_TLV_NETWORK_LIST_OFFLOAD_CONFIG_CMDID,
+        .gtk_offload_cmdid = WMI_TLV_GTK_OFFLOAD_CMDID,
+        .csa_offload_enable_cmdid = WMI_TLV_CSA_OFFLOAD_ENABLE_CMDID,
+        .csa_offload_chanswitch_cmdid = WMI_TLV_CSA_OFFLOAD_CHANSWITCH_CMDID,
+        .chatter_set_mode_cmdid = WMI_TLV_CHATTER_SET_MODE_CMDID,
+        .peer_tid_addba_cmdid = WMI_TLV_PEER_TID_ADDBA_CMDID,
+        .peer_tid_delba_cmdid = WMI_TLV_PEER_TID_DELBA_CMDID,
+        .sta_dtim_ps_method_cmdid = WMI_TLV_STA_DTIM_PS_METHOD_CMDID,
+        .sta_uapsd_auto_trig_cmdid = WMI_TLV_STA_UAPSD_AUTO_TRIG_CMDID,
+        .sta_keepalive_cmd = WMI_TLV_STA_KEEPALIVE_CMDID,
+        .echo_cmdid = WMI_TLV_ECHO_CMDID,
+        .pdev_utf_cmdid = WMI_TLV_PDEV_UTF_CMDID,
+        .dbglog_cfg_cmdid = WMI_TLV_DBGLOG_CFG_CMDID,
+        .pdev_qvit_cmdid = WMI_TLV_PDEV_QVIT_CMDID,
+        .pdev_ftm_intg_cmdid = WMI_TLV_PDEV_FTM_INTG_CMDID,
+        .vdev_set_keepalive_cmdid = WMI_TLV_VDEV_SET_KEEPALIVE_CMDID,
+        .vdev_get_keepalive_cmdid = WMI_TLV_VDEV_GET_KEEPALIVE_CMDID,
+        .force_fw_hang_cmdid = WMI_TLV_FORCE_FW_HANG_CMDID,
+        .gpio_config_cmdid = WMI_TLV_GPIO_CONFIG_CMDID,
+        .gpio_output_cmdid = WMI_TLV_GPIO_OUTPUT_CMDID,
+        .pdev_get_temperature_cmdid = WMI_TLV_CMD_UNSUPPORTED,
+        .vdev_set_wmm_params_cmdid = WMI_TLV_VDEV_SET_WMM_PARAMS_CMDID,
+};
+
+static struct wmi_pdev_param_map wmi_tlv_pdev_param_map = {
+        .tx_chain_mask = WMI_TLV_PDEV_PARAM_TX_CHAIN_MASK,
+        .rx_chain_mask = WMI_TLV_PDEV_PARAM_RX_CHAIN_MASK,
+        .txpower_limit2g = WMI_TLV_PDEV_PARAM_TXPOWER_LIMIT2G,
+        .txpower_limit5g = WMI_TLV_PDEV_PARAM_TXPOWER_LIMIT5G,
+        .txpower_scale = WMI_TLV_PDEV_PARAM_TXPOWER_SCALE,
+        .beacon_gen_mode = WMI_TLV_PDEV_PARAM_BEACON_GEN_MODE,
+        .beacon_tx_mode = WMI_TLV_PDEV_PARAM_BEACON_TX_MODE,
+        .resmgr_offchan_mode = WMI_TLV_PDEV_PARAM_RESMGR_OFFCHAN_MODE,
+        .protection_mode = WMI_TLV_PDEV_PARAM_PROTECTION_MODE,
+        .dynamic_bw = WMI_TLV_PDEV_PARAM_DYNAMIC_BW,
+        .non_agg_sw_retry_th = WMI_TLV_PDEV_PARAM_NON_AGG_SW_RETRY_TH,
+        .agg_sw_retry_th = WMI_TLV_PDEV_PARAM_AGG_SW_RETRY_TH,
+        .sta_kickout_th = WMI_TLV_PDEV_PARAM_STA_KICKOUT_TH,
+        .ac_aggrsize_scaling = WMI_TLV_PDEV_PARAM_AC_AGGRSIZE_SCALING,
+        .ltr_enable = WMI_TLV_PDEV_PARAM_LTR_ENABLE,
+        .ltr_ac_latency_be = WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_BE,
+        .ltr_ac_latency_bk = WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_BK,
+        .ltr_ac_latency_vi = WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_VI,
+        .ltr_ac_latency_vo = WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_VO,
+        .ltr_ac_latency_timeout = WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_TIMEOUT,
+        .ltr_sleep_override = WMI_TLV_PDEV_PARAM_LTR_SLEEP_OVERRIDE,
+        .ltr_rx_override = WMI_TLV_PDEV_PARAM_LTR_RX_OVERRIDE,
+        .ltr_tx_activity_timeout = WMI_TLV_PDEV_PARAM_LTR_TX_ACTIVITY_TIMEOUT,
+        .l1ss_enable = WMI_TLV_PDEV_PARAM_L1SS_ENABLE,
+        .dsleep_enable = WMI_TLV_PDEV_PARAM_DSLEEP_ENABLE,
+        .pcielp_txbuf_flush = WMI_TLV_PDEV_PARAM_PCIELP_TXBUF_FLUSH,
+        .pcielp_txbuf_watermark = WMI_TLV_PDEV_PARAM_PCIELP_TXBUF_TMO_EN,
+        .pcielp_txbuf_tmo_en = WMI_TLV_PDEV_PARAM_PCIELP_TXBUF_TMO_EN,
+        .pcielp_txbuf_tmo_value = WMI_TLV_PDEV_PARAM_PCIELP_TXBUF_TMO_VALUE,
+        .pdev_stats_update_period = WMI_TLV_PDEV_PARAM_PDEV_STATS_UPDATE_PERIOD,
+        .vdev_stats_update_period = WMI_TLV_PDEV_PARAM_VDEV_STATS_UPDATE_PERIOD,
+        .peer_stats_update_period = WMI_TLV_PDEV_PARAM_PEER_STATS_UPDATE_PERIOD,
+        .bcnflt_stats_update_period =
+                                WMI_TLV_PDEV_PARAM_BCNFLT_STATS_UPDATE_PERIOD,
+        .pmf_qos = WMI_TLV_PDEV_PARAM_PMF_QOS,
+        .arp_ac_override = WMI_TLV_PDEV_PARAM_ARP_AC_OVERRIDE,
+        .dcs = WMI_TLV_PDEV_PARAM_DCS,
+        .ani_enable = WMI_TLV_PDEV_PARAM_ANI_ENABLE,
+        .ani_poll_period = WMI_TLV_PDEV_PARAM_ANI_POLL_PERIOD,
+        .ani_listen_period = WMI_TLV_PDEV_PARAM_ANI_LISTEN_PERIOD,
+        .ani_ofdm_level = WMI_TLV_PDEV_PARAM_ANI_OFDM_LEVEL,
+        .ani_cck_level = WMI_TLV_PDEV_PARAM_ANI_CCK_LEVEL,
+        .dyntxchain = WMI_TLV_PDEV_PARAM_DYNTXCHAIN,
+        .proxy_sta = WMI_TLV_PDEV_PARAM_PROXY_STA,
+        .idle_ps_config = WMI_TLV_PDEV_PARAM_IDLE_PS_CONFIG,
+        .power_gating_sleep = WMI_TLV_PDEV_PARAM_POWER_GATING_SLEEP,
+        .fast_channel_reset = WMI_TLV_PDEV_PARAM_UNSUPPORTED,
+        .burst_dur = WMI_TLV_PDEV_PARAM_BURST_DUR,
+        .burst_enable = WMI_TLV_PDEV_PARAM_BURST_ENABLE,
+        .cal_period = WMI_PDEV_PARAM_UNSUPPORTED,
+};
+
+static struct wmi_vdev_param_map wmi_tlv_vdev_param_map = {
+        .rts_threshold = WMI_TLV_VDEV_PARAM_RTS_THRESHOLD,
+        .fragmentation_threshold = WMI_TLV_VDEV_PARAM_FRAGMENTATION_THRESHOLD,
+        .beacon_interval = WMI_TLV_VDEV_PARAM_BEACON_INTERVAL,
+        .listen_interval = WMI_TLV_VDEV_PARAM_LISTEN_INTERVAL,
+        .multicast_rate = WMI_TLV_VDEV_PARAM_MULTICAST_RATE,
+        .mgmt_tx_rate = WMI_TLV_VDEV_PARAM_MGMT_TX_RATE,
+        .slot_time = WMI_TLV_VDEV_PARAM_SLOT_TIME,
+        .preamble = WMI_TLV_VDEV_PARAM_PREAMBLE,
+        .swba_time = WMI_TLV_VDEV_PARAM_SWBA_TIME,
+        .wmi_vdev_stats_update_period = WMI_TLV_VDEV_STATS_UPDATE_PERIOD,
+        .wmi_vdev_pwrsave_ageout_time = WMI_TLV_VDEV_PWRSAVE_AGEOUT_TIME,
+        .wmi_vdev_host_swba_interval = WMI_TLV_VDEV_HOST_SWBA_INTERVAL,
+        .dtim_period = WMI_TLV_VDEV_PARAM_DTIM_PERIOD,
+        .wmi_vdev_oc_scheduler_air_time_limit =
+                                WMI_TLV_VDEV_OC_SCHEDULER_AIR_TIME_LIMIT,
+        .wds = WMI_TLV_VDEV_PARAM_WDS,
+        .atim_window = WMI_TLV_VDEV_PARAM_ATIM_WINDOW,
+        .bmiss_count_max = WMI_TLV_VDEV_PARAM_BMISS_COUNT_MAX,
+        .bmiss_first_bcnt = WMI_TLV_VDEV_PARAM_BMISS_FIRST_BCNT,
+        .bmiss_final_bcnt = WMI_TLV_VDEV_PARAM_BMISS_FINAL_BCNT,
+        .feature_wmm = WMI_TLV_VDEV_PARAM_FEATURE_WMM,
+        .chwidth = WMI_TLV_VDEV_PARAM_CHWIDTH,
+        .chextoffset = WMI_TLV_VDEV_PARAM_CHEXTOFFSET,
+        .disable_htprotection = WMI_TLV_VDEV_PARAM_DISABLE_HTPROTECTION,
+        .sta_quickkickout = WMI_TLV_VDEV_PARAM_STA_QUICKKICKOUT,
+        .mgmt_rate = WMI_TLV_VDEV_PARAM_MGMT_RATE,
+        .protection_mode = WMI_TLV_VDEV_PARAM_PROTECTION_MODE,
+        .fixed_rate = WMI_TLV_VDEV_PARAM_FIXED_RATE,
+        .sgi = WMI_TLV_VDEV_PARAM_SGI,
+        .ldpc = WMI_TLV_VDEV_PARAM_LDPC,
+        .tx_stbc = WMI_TLV_VDEV_PARAM_TX_STBC,
+        .rx_stbc = WMI_TLV_VDEV_PARAM_RX_STBC,
+        .intra_bss_fwd = WMI_TLV_VDEV_PARAM_INTRA_BSS_FWD,
+        .def_keyid = WMI_TLV_VDEV_PARAM_DEF_KEYID,
+        .nss = WMI_TLV_VDEV_PARAM_NSS,
+        .bcast_data_rate = WMI_TLV_VDEV_PARAM_BCAST_DATA_RATE,
+        .mcast_data_rate = WMI_TLV_VDEV_PARAM_MCAST_DATA_RATE,
+        .mcast_indicate = WMI_TLV_VDEV_PARAM_MCAST_INDICATE,
+        .dhcp_indicate = WMI_TLV_VDEV_PARAM_DHCP_INDICATE,
+        .unknown_dest_indicate = WMI_TLV_VDEV_PARAM_UNKNOWN_DEST_INDICATE,
+        .ap_keepalive_min_idle_inactive_time_secs =
+                WMI_TLV_VDEV_PARAM_AP_KEEPALIVE_MIN_IDLE_INACTIVE_TIME_SECS,
+        .ap_keepalive_max_idle_inactive_time_secs =
+                WMI_TLV_VDEV_PARAM_AP_KEEPALIVE_MAX_IDLE_INACTIVE_TIME_SECS,
+        .ap_keepalive_max_unresponsive_time_secs =
+                WMI_TLV_VDEV_PARAM_AP_KEEPALIVE_MAX_UNRESPONSIVE_TIME_SECS,
+        .ap_enable_nawds = WMI_TLV_VDEV_PARAM_AP_ENABLE_NAWDS,
+        .mcast2ucast_set = WMI_TLV_VDEV_PARAM_UNSUPPORTED,
+        .enable_rtscts = WMI_TLV_VDEV_PARAM_ENABLE_RTSCTS,
+        .txbf = WMI_TLV_VDEV_PARAM_TXBF,
+        .packet_powersave = WMI_TLV_VDEV_PARAM_PACKET_POWERSAVE,
+        .drop_unencry = WMI_TLV_VDEV_PARAM_DROP_UNENCRY,
+        .tx_encap_type = WMI_TLV_VDEV_PARAM_TX_ENCAP_TYPE,
+        .ap_detect_out_of_sync_sleeping_sta_time_secs =
+                                        WMI_TLV_VDEV_PARAM_UNSUPPORTED,
+};
+
+static const struct wmi_ops wmi_tlv_ops = {
+        .rx = ath10k_wmi_tlv_op_rx,
+        .map_svc = wmi_tlv_svc_map,
+
+        .pull_scan = ath10k_wmi_tlv_op_pull_scan_ev,
+        .pull_mgmt_rx = ath10k_wmi_tlv_op_pull_mgmt_rx_ev,
+        .pull_ch_info = ath10k_wmi_tlv_op_pull_ch_info_ev,
+        .pull_vdev_start = ath10k_wmi_tlv_op_pull_vdev_start_ev,
+        .pull_peer_kick = ath10k_wmi_tlv_op_pull_peer_kick_ev,
+        .pull_swba = ath10k_wmi_tlv_op_pull_swba_ev,
+        .pull_phyerr = ath10k_wmi_tlv_op_pull_phyerr_ev,
+        .pull_svc_rdy = ath10k_wmi_tlv_op_pull_svc_rdy_ev,
+        .pull_rdy = ath10k_wmi_tlv_op_pull_rdy_ev,
+        .pull_fw_stats = ath10k_wmi_tlv_op_pull_fw_stats,
+
+        .gen_pdev_suspend = ath10k_wmi_tlv_op_gen_pdev_suspend,
+        .gen_pdev_resume = ath10k_wmi_tlv_op_gen_pdev_resume,
+        .gen_pdev_set_rd = ath10k_wmi_tlv_op_gen_pdev_set_rd,
+        .gen_pdev_set_param = ath10k_wmi_tlv_op_gen_pdev_set_param,
+        .gen_init = ath10k_wmi_tlv_op_gen_init,
+        .gen_start_scan = ath10k_wmi_tlv_op_gen_start_scan,
+        .gen_stop_scan = ath10k_wmi_tlv_op_gen_stop_scan,
+        .gen_vdev_create = ath10k_wmi_tlv_op_gen_vdev_create,
+        .gen_vdev_delete = ath10k_wmi_tlv_op_gen_vdev_delete,
+        .gen_vdev_start = ath10k_wmi_tlv_op_gen_vdev_start,
+        .gen_vdev_stop = ath10k_wmi_tlv_op_gen_vdev_stop,
+        .gen_vdev_up = ath10k_wmi_tlv_op_gen_vdev_up,
+        .gen_vdev_down = ath10k_wmi_tlv_op_gen_vdev_down,
+        .gen_vdev_set_param = ath10k_wmi_tlv_op_gen_vdev_set_param,
+        .gen_vdev_install_key = ath10k_wmi_tlv_op_gen_vdev_install_key,
+        .gen_vdev_wmm_conf = ath10k_wmi_tlv_op_gen_vdev_wmm_conf,
+        .gen_peer_create = ath10k_wmi_tlv_op_gen_peer_create,
+        .gen_peer_delete = ath10k_wmi_tlv_op_gen_peer_delete,
+        .gen_peer_flush = ath10k_wmi_tlv_op_gen_peer_flush,
+        .gen_peer_set_param = ath10k_wmi_tlv_op_gen_peer_set_param,
+        .gen_peer_assoc = ath10k_wmi_tlv_op_gen_peer_assoc,
+        .gen_set_psmode = ath10k_wmi_tlv_op_gen_set_psmode,
+        .gen_set_sta_ps = ath10k_wmi_tlv_op_gen_set_sta_ps,
+        .gen_set_ap_ps = ath10k_wmi_tlv_op_gen_set_ap_ps,
+        .gen_scan_chan_list = ath10k_wmi_tlv_op_gen_scan_chan_list,
+        .gen_beacon_dma = ath10k_wmi_tlv_op_gen_beacon_dma,
+        .gen_pdev_set_wmm = ath10k_wmi_tlv_op_gen_pdev_set_wmm,
+        .gen_request_stats = ath10k_wmi_tlv_op_gen_request_stats,
+        .gen_force_fw_hang = ath10k_wmi_tlv_op_gen_force_fw_hang,
+        /* .gen_mgmt_tx = not implemented; HTT is used */
+        .gen_dbglog_cfg = ath10k_wmi_tlv_op_gen_dbglog_cfg,
+        .gen_pktlog_enable = ath10k_wmi_tlv_op_gen_pktlog_enable,
+        .gen_pktlog_disable = ath10k_wmi_tlv_op_gen_pktlog_disable,
+        /* .gen_pdev_set_quiet_mode not implemented */
+        /* .gen_pdev_get_temperature not implemented */
+        /* .gen_addba_clear_resp not implemented */
+        /* .gen_addba_send not implemented */
+        /* .gen_addba_set_resp not implemented */
+        /* .gen_delba_send not implemented */
+        .gen_bcn_tmpl = ath10k_wmi_tlv_op_gen_bcn_tmpl,
+        .gen_prb_tmpl = ath10k_wmi_tlv_op_gen_prb_tmpl,
+        .gen_p2p_go_bcn_ie = ath10k_wmi_tlv_op_gen_p2p_go_bcn_ie,
+        .gen_vdev_sta_uapsd = ath10k_wmi_tlv_op_gen_vdev_sta_uapsd,
+        .gen_sta_keepalive = ath10k_wmi_tlv_op_gen_sta_keepalive,
+};
+
+/************/
+/* TLV init */
+/************/
+
+void ath10k_wmi_tlv_attach(struct ath10k *ar)
+{
+        ar->wmi.cmd = &wmi_tlv_cmd_map;
+        ar->wmi.vdev_param = &wmi_tlv_vdev_param_map;
+        ar->wmi.pdev_param = &wmi_tlv_pdev_param_map;
+        ar->wmi.ops = &wmi_tlv_ops;
+}
diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.h b/drivers/net/wireless/ath/ath10k/wmi-tlv.h
new file mode 100644
index 000000000000..de68fe76eae6
--- /dev/null
+++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.h
@@ -0,0 +1,1444 @@
+/*
+ * Copyright (c) 2005-2011 Atheros Communications Inc.
+ * Copyright (c) 2011-2014 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef _WMI_TLV_H
+#define _WMI_TLV_H
+
+#define WMI_TLV_CMD(grp_id) (((grp_id) << 12) | 0x1)
+#define WMI_TLV_EV(grp_id) (((grp_id) << 12) | 0x1)
+#define WMI_TLV_CMD_UNSUPPORTED 0
+#define WMI_TLV_PDEV_PARAM_UNSUPPORTED 0
+#define WMI_TLV_VDEV_PARAM_UNSUPPORTED 0
+
+enum wmi_tlv_grp_id {
+        WMI_TLV_GRP_START = 0x3,
+        WMI_TLV_GRP_SCAN = WMI_TLV_GRP_START,
+        WMI_TLV_GRP_PDEV,
+        WMI_TLV_GRP_VDEV,
+        WMI_TLV_GRP_PEER,
+        WMI_TLV_GRP_MGMT,
+        WMI_TLV_GRP_BA_NEG,
+        WMI_TLV_GRP_STA_PS,
+        WMI_TLV_GRP_DFS,
+        WMI_TLV_GRP_ROAM,
+        WMI_TLV_GRP_OFL_SCAN,
+        WMI_TLV_GRP_P2P,
+        WMI_TLV_GRP_AP_PS,
+        WMI_TLV_GRP_RATECTL,
+        WMI_TLV_GRP_PROFILE,
+        WMI_TLV_GRP_SUSPEND,
+        WMI_TLV_GRP_BCN_FILTER,
+        WMI_TLV_GRP_WOW,
+        WMI_TLV_GRP_RTT,
+        WMI_TLV_GRP_SPECTRAL,
+        WMI_TLV_GRP_STATS,
+        WMI_TLV_GRP_ARP_NS_OFL,
+        WMI_TLV_GRP_NLO_OFL,
+        WMI_TLV_GRP_GTK_OFL,
+        WMI_TLV_GRP_CSA_OFL,
+        WMI_TLV_GRP_CHATTER,
+        WMI_TLV_GRP_TID_ADDBA,
+        WMI_TLV_GRP_MISC,
+        WMI_TLV_GRP_GPIO,
+        WMI_TLV_GRP_FWTEST,
+        WMI_TLV_GRP_TDLS,
+        WMI_TLV_GRP_RESMGR,
+        WMI_TLV_GRP_STA_SMPS,
+        WMI_TLV_GRP_WLAN_HB,
+        WMI_TLV_GRP_RMC,
+        WMI_TLV_GRP_MHF_OFL,
+        WMI_TLV_GRP_LOCATION_SCAN,
+        WMI_TLV_GRP_OEM,
+        WMI_TLV_GRP_NAN,
+        WMI_TLV_GRP_COEX,
+        WMI_TLV_GRP_OBSS_OFL,
+        WMI_TLV_GRP_LPI,
+        WMI_TLV_GRP_EXTSCAN,
+        WMI_TLV_GRP_DHCP_OFL,
+        WMI_TLV_GRP_IPA,
+        WMI_TLV_GRP_MDNS_OFL,
+        WMI_TLV_GRP_SAP_OFL,
+};
+
+enum wmi_tlv_cmd_id {
+        WMI_TLV_INIT_CMDID = 0x1,
+        WMI_TLV_START_SCAN_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_SCAN),
+        WMI_TLV_STOP_SCAN_CMDID,
+        WMI_TLV_SCAN_CHAN_LIST_CMDID,
+        WMI_TLV_SCAN_SCH_PRIO_TBL_CMDID,
+        WMI_TLV_SCAN_UPDATE_REQUEST_CMDID,
+        WMI_TLV_SCAN_PROB_REQ_OUI_CMDID,
+        WMI_TLV_PDEV_SET_REGDOMAIN_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_PDEV),
+        WMI_TLV_PDEV_SET_CHANNEL_CMDID,
+        WMI_TLV_PDEV_SET_PARAM_CMDID,
+        WMI_TLV_PDEV_PKTLOG_ENABLE_CMDID,
+        WMI_TLV_PDEV_PKTLOG_DISABLE_CMDID,
+        WMI_TLV_PDEV_SET_WMM_PARAMS_CMDID,
+        WMI_TLV_PDEV_SET_HT_CAP_IE_CMDID,
+        WMI_TLV_PDEV_SET_VHT_CAP_IE_CMDID,
+        WMI_TLV_PDEV_SET_DSCP_TID_MAP_CMDID,
+        WMI_TLV_PDEV_SET_QUIET_MODE_CMDID,
+        WMI_TLV_PDEV_GREEN_AP_PS_ENABLE_CMDID,
+        WMI_TLV_PDEV_GET_TPC_CONFIG_CMDID,
+        WMI_TLV_PDEV_SET_BASE_MACADDR_CMDID,
+        WMI_TLV_PDEV_DUMP_CMDID,
+        WMI_TLV_PDEV_SET_LED_CONFIG_CMDID,
+        WMI_TLV_PDEV_GET_TEMPERATURE_CMDID,
+        WMI_TLV_PDEV_SET_LED_FLASHING_CMDID,
+        WMI_TLV_VDEV_CREATE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_VDEV),
+        WMI_TLV_VDEV_DELETE_CMDID,
+        WMI_TLV_VDEV_START_REQUEST_CMDID,
+        WMI_TLV_VDEV_RESTART_REQUEST_CMDID,
+        WMI_TLV_VDEV_UP_CMDID,
+        WMI_TLV_VDEV_STOP_CMDID,
+        WMI_TLV_VDEV_DOWN_CMDID,
+        WMI_TLV_VDEV_SET_PARAM_CMDID,
+        WMI_TLV_VDEV_INSTALL_KEY_CMDID,
+        WMI_TLV_VDEV_WNM_SLEEPMODE_CMDID,
+        WMI_TLV_VDEV_WMM_ADDTS_CMDID,
+        WMI_TLV_VDEV_WMM_DELTS_CMDID,
+        WMI_TLV_VDEV_SET_WMM_PARAMS_CMDID,
+        WMI_TLV_VDEV_SET_GTX_PARAMS_CMDID,
+        WMI_TLV_VDEV_IPSEC_NATKEEPALIVE_FILTER_CMDID,
+        WMI_TLV_VDEV_PLMREQ_START_CMDID,
+        WMI_TLV_VDEV_PLMREQ_STOP_CMDID,
+        WMI_TLV_PEER_CREATE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_PEER),
+        WMI_TLV_PEER_DELETE_CMDID,
+        WMI_TLV_PEER_FLUSH_TIDS_CMDID,
+        WMI_TLV_PEER_SET_PARAM_CMDID,
+        WMI_TLV_PEER_ASSOC_CMDID,
+        WMI_TLV_PEER_ADD_WDS_ENTRY_CMDID,
+        WMI_TLV_PEER_REMOVE_WDS_ENTRY_CMDID,
+        WMI_TLV_PEER_MCAST_GROUP_CMDID,
+        WMI_TLV_PEER_INFO_REQ_CMDID,
+        WMI_TLV_PEER_GET_ESTIMATED_LINKSPEED_CMDID,
+        WMI_TLV_BCN_TX_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_MGMT),
+        WMI_TLV_PDEV_SEND_BCN_CMDID,
+        WMI_TLV_BCN_TMPL_CMDID,
+        WMI_TLV_BCN_FILTER_RX_CMDID,
+        WMI_TLV_PRB_REQ_FILTER_RX_CMDID,
+        WMI_TLV_MGMT_TX_CMDID,
+        WMI_TLV_PRB_TMPL_CMDID,
+        WMI_TLV_ADDBA_CLEAR_RESP_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_BA_NEG),
+        WMI_TLV_ADDBA_SEND_CMDID,
+        WMI_TLV_ADDBA_STATUS_CMDID,
+        WMI_TLV_DELBA_SEND_CMDID,
+        WMI_TLV_ADDBA_SET_RESP_CMDID,
+        WMI_TLV_SEND_SINGLEAMSDU_CMDID,
+        WMI_TLV_STA_POWERSAVE_MODE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_STA_PS),
+        WMI_TLV_STA_POWERSAVE_PARAM_CMDID,
+        WMI_TLV_STA_MIMO_PS_MODE_CMDID,
+        WMI_TLV_PDEV_DFS_ENABLE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_DFS),
+        WMI_TLV_PDEV_DFS_DISABLE_CMDID,
+        WMI_TLV_DFS_PHYERR_FILTER_ENA_CMDID,
+        WMI_TLV_DFS_PHYERR_FILTER_DIS_CMDID,
+        WMI_TLV_ROAM_SCAN_MODE = WMI_TLV_CMD(WMI_TLV_GRP_ROAM),
+        WMI_TLV_ROAM_SCAN_RSSI_THRESHOLD,
+        WMI_TLV_ROAM_SCAN_PERIOD,
+        WMI_TLV_ROAM_SCAN_RSSI_CHANGE_THRESHOLD,
+        WMI_TLV_ROAM_AP_PROFILE,
+        WMI_TLV_ROAM_CHAN_LIST,
+        WMI_TLV_ROAM_SCAN_CMD,
+        WMI_TLV_ROAM_SYNCH_COMPLETE,
+        WMI_TLV_ROAM_SET_RIC_REQUEST_CMDID,
+        WMI_TLV_ROAM_INVOKE_CMDID,
+        WMI_TLV_OFL_SCAN_ADD_AP_PROFILE = WMI_TLV_CMD(WMI_TLV_GRP_OFL_SCAN),
+        WMI_TLV_OFL_SCAN_REMOVE_AP_PROFILE,
+        WMI_TLV_OFL_SCAN_PERIOD,
+        WMI_TLV_P2P_DEV_SET_DEVICE_INFO = WMI_TLV_CMD(WMI_TLV_GRP_P2P),
+        WMI_TLV_P2P_DEV_SET_DISCOVERABILITY,
+        WMI_TLV_P2P_GO_SET_BEACON_IE,
+        WMI_TLV_P2P_GO_SET_PROBE_RESP_IE,
+        WMI_TLV_P2P_SET_VENDOR_IE_DATA_CMDID,
+        WMI_TLV_P2P_DISC_OFFLOAD_CONFIG_CMDID,
+        WMI_TLV_P2P_DISC_OFFLOAD_APPIE_CMDID,
+        WMI_TLV_P2P_DISC_OFFLOAD_PATTERN_CMDID,
+        WMI_TLV_P2P_SET_OPPPS_PARAM_CMDID,
+        WMI_TLV_AP_PS_PEER_PARAM_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_AP_PS),
+        WMI_TLV_AP_PS_PEER_UAPSD_COEX_CMDID,
+        WMI_TLV_PEER_RATE_RETRY_SCHED_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_RATECTL),
+        WMI_TLV_WLAN_PROFILE_TRIGGER_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_PROFILE),
+        WMI_TLV_WLAN_PROFILE_SET_HIST_INTVL_CMDID,
+        WMI_TLV_WLAN_PROFILE_GET_PROFILE_DATA_CMDID,
+        WMI_TLV_WLAN_PROFILE_ENABLE_PROFILE_ID_CMDID,
+        WMI_TLV_WLAN_PROFILE_LIST_PROFILE_ID_CMDID,
+        WMI_TLV_PDEV_SUSPEND_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_SUSPEND),
+        WMI_TLV_PDEV_RESUME_CMDID,
+        WMI_TLV_ADD_BCN_FILTER_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_BCN_FILTER),
+        WMI_TLV_RMV_BCN_FILTER_CMDID,
+        WMI_TLV_WOW_ADD_WAKE_PATTERN_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_WOW),
+        WMI_TLV_WOW_DEL_WAKE_PATTERN_CMDID,
+        WMI_TLV_WOW_ENABLE_DISABLE_WAKE_EVENT_CMDID,
+        WMI_TLV_WOW_ENABLE_CMDID,
+        WMI_TLV_WOW_HOSTWAKEUP_FROM_SLEEP_CMDID,
+        WMI_TLV_WOW_ACER_IOAC_ADD_KEEPALIVE_CMDID,
+        WMI_TLV_WOW_ACER_IOAC_DEL_KEEPALIVE_CMDID,
+        WMI_TLV_WOW_ACER_IOAC_ADD_WAKE_PATTERN_CMDID,
+        WMI_TLV_WOW_ACER_IOAC_DEL_WAKE_PATTERN_CMDID,
+        WMI_TLV_D0_WOW_ENABLE_DISABLE_CMDID,
+        WMI_TLV_EXTWOW_ENABLE_CMDID,
+        WMI_TLV_EXTWOW_SET_APP_TYPE1_PARAMS_CMDID,
+        WMI_TLV_EXTWOW_SET_APP_TYPE2_PARAMS_CMDID,
+        WMI_TLV_RTT_MEASREQ_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_RTT),
+        WMI_TLV_RTT_TSF_CMDID,
+        WMI_TLV_SPECTRAL_SCAN_CONF_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_SPECTRAL),
+        WMI_TLV_SPECTRAL_SCAN_ENABLE_CMDID,
+        WMI_TLV_REQUEST_STATS_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_STATS),
+        WMI_TLV_MCC_SCHED_TRAFFIC_STATS_CMDID,
+        WMI_TLV_REQUEST_STATS_EXT_CMDID,
+        WMI_TLV_REQUEST_LINK_STATS_CMDID,
+        WMI_TLV_START_LINK_STATS_CMDID,
+        WMI_TLV_CLEAR_LINK_STATS_CMDID,
+        WMI_TLV_SET_ARP_NS_OFFLOAD_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_ARP_NS_OFL),
+        WMI_TLV_ADD_PROACTIVE_ARP_RSP_PATTERN_CMDID,
+        WMI_TLV_DEL_PROACTIVE_ARP_RSP_PATTERN_CMDID,
+        WMI_TLV_NETWORK_LIST_OFFLOAD_CONFIG_CMDID =
+                        WMI_TLV_CMD(WMI_TLV_GRP_NLO_OFL),
+        WMI_TLV_APFIND_CMDID,
+        WMI_TLV_GTK_OFFLOAD_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_GTK_OFL),
+        WMI_TLV_CSA_OFFLOAD_ENABLE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_CSA_OFL),
+        WMI_TLV_CSA_OFFLOAD_CHANSWITCH_CMDID,
+        WMI_TLV_CHATTER_SET_MODE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_CHATTER),
+        WMI_TLV_CHATTER_ADD_COALESCING_FILTER_CMDID,
+        WMI_TLV_CHATTER_DELETE_COALESCING_FILTER_CMDID,
+        WMI_TLV_CHATTER_COALESCING_QUERY_CMDID,
+        WMI_TLV_PEER_TID_ADDBA_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_TID_ADDBA),
+        WMI_TLV_PEER_TID_DELBA_CMDID,
+        WMI_TLV_STA_DTIM_PS_METHOD_CMDID,
+        WMI_TLV_STA_UAPSD_AUTO_TRIG_CMDID,
+        WMI_TLV_STA_KEEPALIVE_CMDID,
+        WMI_TLV_BA_REQ_SSN_CMDID,
+        WMI_TLV_ECHO_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_MISC),
+        WMI_TLV_PDEV_UTF_CMDID,
+        WMI_TLV_DBGLOG_CFG_CMDID,
+        WMI_TLV_PDEV_QVIT_CMDID,
+        WMI_TLV_PDEV_FTM_INTG_CMDID,
+        WMI_TLV_VDEV_SET_KEEPALIVE_CMDID,
+        WMI_TLV_VDEV_GET_KEEPALIVE_CMDID,
+        WMI_TLV_FORCE_FW_HANG_CMDID,
+        WMI_TLV_SET_MCASTBCAST_FILTER_CMDID,
+        WMI_TLV_THERMAL_MGMT_CMDID,
+        WMI_TLV_HOST_AUTO_SHUTDOWN_CFG_CMDID,
+        WMI_TLV_TPC_CHAINMASK_CONFIG_CMDID,
+        WMI_TLV_SET_ANTENNA_DIVERSITY_CMDID,
+        WMI_TLV_GPIO_CONFIG_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_GPIO),
+        WMI_TLV_GPIO_OUTPUT_CMDID,
+        WMI_TLV_TXBF_CMDID,
+        WMI_TLV_FWTEST_VDEV_MCC_SET_TBTT_MODE_CMDID =
+                        WMI_TLV_CMD(WMI_TLV_GRP_FWTEST),
+        WMI_TLV_FWTEST_P2P_SET_NOA_PARAM_CMDID,
+        WMI_TLV_UNIT_TEST_CMDID,
+        WMI_TLV_TDLS_SET_STATE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_TDLS),
+        WMI_TLV_TDLS_PEER_UPDATE_CMDID,
+        WMI_TLV_TDLS_SET_OFFCHAN_MODE_CMDID,
+        WMI_TLV_RESMGR_ADAPTIVE_OCS_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_RESMGR),
+        WMI_TLV_RESMGR_SET_CHAN_TIME_QUOTA_CMDID,
+        WMI_TLV_RESMGR_SET_CHAN_LATENCY_CMDID,
+        WMI_TLV_STA_SMPS_FORCE_MODE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_STA_SMPS),
+        WMI_TLV_STA_SMPS_PARAM_CMDID,
+        WMI_TLV_HB_SET_ENABLE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_WLAN_HB),
+        WMI_TLV_HB_SET_TCP_PARAMS_CMDID,
+        WMI_TLV_HB_SET_TCP_PKT_FILTER_CMDID,
+        WMI_TLV_HB_SET_UDP_PARAMS_CMDID,
+        WMI_TLV_HB_SET_UDP_PKT_FILTER_CMDID,
+        WMI_TLV_RMC_SET_MODE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_RMC),
+        WMI_TLV_RMC_SET_ACTION_PERIOD_CMDID,
+        WMI_TLV_RMC_CONFIG_CMDID,
+        WMI_TLV_MHF_OFFLOAD_SET_MODE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_MHF_OFL),
+        WMI_TLV_MHF_OFFLOAD_PLUMB_ROUTING_TBL_CMDID,
+        WMI_TLV_BATCH_SCAN_ENABLE_CMDID =
+                        WMI_TLV_CMD(WMI_TLV_GRP_LOCATION_SCAN),
+        WMI_TLV_BATCH_SCAN_DISABLE_CMDID,
+        WMI_TLV_BATCH_SCAN_TRIGGER_RESULT_CMDID,
+        WMI_TLV_OEM_REQ_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_OEM),
+        WMI_TLV_NAN_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_NAN),
+        WMI_TLV_MODEM_POWER_STATE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_COEX),
+        WMI_TLV_CHAN_AVOID_UPDATE_CMDID,
+        WMI_TLV_OBSS_SCAN_ENABLE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_OBSS_OFL),
+        WMI_TLV_OBSS_SCAN_DISABLE_CMDID,
+        WMI_TLV_LPI_MGMT_SNOOPING_CONFIG_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_LPI),
+        WMI_TLV_LPI_START_SCAN_CMDID,
+        WMI_TLV_LPI_STOP_SCAN_CMDID,
+        WMI_TLV_EXTSCAN_START_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_EXTSCAN),
+        WMI_TLV_EXTSCAN_STOP_CMDID,
+        WMI_TLV_EXTSCAN_CONFIGURE_WLAN_CHANGE_MONITOR_CMDID,
+        WMI_TLV_EXTSCAN_CONFIGURE_HOTLIST_MONITOR_CMDID,
+        WMI_TLV_EXTSCAN_GET_CACHED_RESULTS_CMDID,
+        WMI_TLV_EXTSCAN_GET_WLAN_CHANGE_RESULTS_CMDID,
+        WMI_TLV_EXTSCAN_SET_CAPABILITIES_CMDID,
+        WMI_TLV_EXTSCAN_GET_CAPABILITIES_CMDID,
+        WMI_TLV_SET_DHCP_SERVER_OFFLOAD_CMDID =
+                        WMI_TLV_CMD(WMI_TLV_GRP_DHCP_OFL),
+        WMI_TLV_IPA_OFFLOAD_ENABLE_DISABLE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_IPA),
+        WMI_TLV_MDNS_OFFLOAD_ENABLE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_MDNS_OFL),
+        WMI_TLV_MDNS_SET_FQDN_CMDID,
+        WMI_TLV_MDNS_SET_RESPONSE_CMDID,
+        WMI_TLV_MDNS_GET_STATS_CMDID,
+        WMI_TLV_SAP_OFL_ENABLE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_SAP_OFL),
+};
+
+enum wmi_tlv_event_id {
+        WMI_TLV_SERVICE_READY_EVENTID = 0x1,
+        WMI_TLV_READY_EVENTID,
+        WMI_TLV_SCAN_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_SCAN),
+        WMI_TLV_PDEV_TPC_CONFIG_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_PDEV),
+        WMI_TLV_CHAN_INFO_EVENTID,
+        WMI_TLV_PHYERR_EVENTID,
+        WMI_TLV_PDEV_DUMP_EVENTID,
+        WMI_TLV_TX_PAUSE_EVENTID,
+        WMI_TLV_DFS_RADAR_EVENTID,
+        WMI_TLV_PDEV_L1SS_TRACK_EVENTID,
+        WMI_TLV_PDEV_TEMPERATURE_EVENTID,
+        WMI_TLV_VDEV_START_RESP_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_VDEV),
+        WMI_TLV_VDEV_STOPPED_EVENTID,
+        WMI_TLV_VDEV_INSTALL_KEY_COMPLETE_EVENTID,
+        WMI_TLV_VDEV_MCC_BCN_INTERVAL_CHANGE_REQ_EVENTID,
+        WMI_TLV_PEER_STA_KICKOUT_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_PEER),
+        WMI_TLV_PEER_INFO_EVENTID,
+        WMI_TLV_PEER_TX_FAIL_CNT_THR_EVENTID,
+        WMI_TLV_PEER_ESTIMATED_LINKSPEED_EVENTID,
+        WMI_TLV_PEER_STATE_EVENTID,
+        WMI_TLV_MGMT_RX_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_MGMT),
+        WMI_TLV_HOST_SWBA_EVENTID,
+        WMI_TLV_TBTTOFFSET_UPDATE_EVENTID,
+        WMI_TLV_OFFLOAD_BCN_TX_STATUS_EVENTID,
+        WMI_TLV_OFFLOAD_PROB_RESP_TX_STATUS_EVENTID,
+        WMI_TLV_TX_DELBA_COMPLETE_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_BA_NEG),
+        WMI_TLV_TX_ADDBA_COMPLETE_EVENTID,
+        WMI_TLV_BA_RSP_SSN_EVENTID,
+        WMI_TLV_AGGR_STATE_TRIG_EVENTID,
+        WMI_TLV_ROAM_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_ROAM),
+        WMI_TLV_PROFILE_MATCH,
+        WMI_TLV_ROAM_SYNCH_EVENTID,
+        WMI_TLV_P2P_DISC_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_P2P),
+        WMI_TLV_P2P_NOA_EVENTID,
+        WMI_TLV_PDEV_RESUME_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_SUSPEND),
+        WMI_TLV_WOW_WAKEUP_HOST_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_WOW),
+        WMI_TLV_D0_WOW_DISABLE_ACK_EVENTID,
+        WMI_TLV_RTT_MEASUREMENT_REPORT_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_RTT),
+        WMI_TLV_TSF_MEASUREMENT_REPORT_EVENTID,
+        WMI_TLV_RTT_ERROR_REPORT_EVENTID,
+        WMI_TLV_STATS_EXT_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_STATS),
+        WMI_TLV_IFACE_LINK_STATS_EVENTID,
+        WMI_TLV_PEER_LINK_STATS_EVENTID,
+        WMI_TLV_RADIO_LINK_STATS_EVENTID,
+        WMI_TLV_NLO_MATCH_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_NLO_OFL),
+        WMI_TLV_NLO_SCAN_COMPLETE_EVENTID,
+        WMI_TLV_APFIND_EVENTID,
+        WMI_TLV_GTK_OFFLOAD_STATUS_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_GTK_OFL),
+        WMI_TLV_GTK_REKEY_FAIL_EVENTID,
+        WMI_TLV_CSA_HANDLING_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_CSA_OFL),
+        WMI_TLV_CHATTER_PC_QUERY_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_CHATTER),
+        WMI_TLV_ECHO_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_MISC),
+        WMI_TLV_PDEV_UTF_EVENTID,
+        WMI_TLV_DEBUG_MESG_EVENTID,
+        WMI_TLV_UPDATE_STATS_EVENTID,
+        WMI_TLV_DEBUG_PRINT_EVENTID,
+        WMI_TLV_DCS_INTERFERENCE_EVENTID,
+        WMI_TLV_PDEV_QVIT_EVENTID,
+        WMI_TLV_WLAN_PROFILE_DATA_EVENTID,
+        WMI_TLV_PDEV_FTM_INTG_EVENTID,
+        WMI_TLV_WLAN_FREQ_AVOID_EVENTID,
+        WMI_TLV_VDEV_GET_KEEPALIVE_EVENTID,
+        WMI_TLV_THERMAL_MGMT_EVENTID,
+        WMI_TLV_DIAG_DATA_CONTAINER_EVENTID,
+        WMI_TLV_HOST_AUTO_SHUTDOWN_EVENTID,
+        WMI_TLV_UPDATE_WHAL_MIB_STATS_EVENTID,
+        WMI_TLV_UPDATE_VDEV_RATE_STATS_EVENTID,
+        WMI_TLV_DIAG_EVENTID,
+        WMI_TLV_GPIO_INPUT_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_GPIO),
+        WMI_TLV_UPLOADH_EVENTID,
+        WMI_TLV_CAPTUREH_EVENTID,
+        WMI_TLV_RFKILL_STATE_CHANGE_EVENTID,
+        WMI_TLV_TDLS_PEER_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_TDLS),
+        WMI_TLV_BATCH_SCAN_ENABLED_EVENTID =
+                        WMI_TLV_EV(WMI_TLV_GRP_LOCATION_SCAN),
+        WMI_TLV_BATCH_SCAN_RESULT_EVENTID,
+        WMI_TLV_OEM_CAPABILITY_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_OEM),
+        WMI_TLV_OEM_MEASUREMENT_REPORT_EVENTID,
+        WMI_TLV_OEM_ERROR_REPORT_EVENTID,
+        WMI_TLV_NAN_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_NAN),
+        WMI_TLV_LPI_RESULT_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_LPI),
+        WMI_TLV_LPI_STATUS_EVENTID,
+        WMI_TLV_LPI_HANDOFF_EVENTID,
+        WMI_TLV_EXTSCAN_START_STOP_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_EXTSCAN),
+        WMI_TLV_EXTSCAN_OPERATION_EVENTID,
+        WMI_TLV_EXTSCAN_TABLE_USAGE_EVENTID,
+        WMI_TLV_EXTSCAN_CACHED_RESULTS_EVENTID,
+        WMI_TLV_EXTSCAN_WLAN_CHANGE_RESULTS_EVENTID,
+        WMI_TLV_EXTSCAN_HOTLIST_MATCH_EVENTID,
+        WMI_TLV_EXTSCAN_CAPABILITIES_EVENTID,
+        WMI_TLV_MDNS_STATS_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_MDNS_OFL),
+        WMI_TLV_SAP_OFL_ADD_STA_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_SAP_OFL),
+        WMI_TLV_SAP_OFL_DEL_STA_EVENTID,
+};
+
+enum wmi_tlv_pdev_param {
+        WMI_TLV_PDEV_PARAM_TX_CHAIN_MASK = 0x1,
+        WMI_TLV_PDEV_PARAM_RX_CHAIN_MASK,
+        WMI_TLV_PDEV_PARAM_TXPOWER_LIMIT2G,
+        WMI_TLV_PDEV_PARAM_TXPOWER_LIMIT5G,
+        WMI_TLV_PDEV_PARAM_TXPOWER_SCALE,
+        WMI_TLV_PDEV_PARAM_BEACON_GEN_MODE,
+        WMI_TLV_PDEV_PARAM_BEACON_TX_MODE,
+        WMI_TLV_PDEV_PARAM_RESMGR_OFFCHAN_MODE,
+        WMI_TLV_PDEV_PARAM_PROTECTION_MODE,
+        WMI_TLV_PDEV_PARAM_DYNAMIC_BW,
+        WMI_TLV_PDEV_PARAM_NON_AGG_SW_RETRY_TH,
+        WMI_TLV_PDEV_PARAM_AGG_SW_RETRY_TH,
+        WMI_TLV_PDEV_PARAM_STA_KICKOUT_TH,
+        WMI_TLV_PDEV_PARAM_AC_AGGRSIZE_SCALING,
+        WMI_TLV_PDEV_PARAM_LTR_ENABLE,
+        WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_BE,
+        WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_BK,
+        WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_VI,
+        WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_VO,
+        WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_TIMEOUT,
+        WMI_TLV_PDEV_PARAM_LTR_SLEEP_OVERRIDE,
+        WMI_TLV_PDEV_PARAM_LTR_RX_OVERRIDE,
+        WMI_TLV_PDEV_PARAM_LTR_TX_ACTIVITY_TIMEOUT,
+        WMI_TLV_PDEV_PARAM_L1SS_ENABLE,
+        WMI_TLV_PDEV_PARAM_DSLEEP_ENABLE,
+        WMI_TLV_PDEV_PARAM_PCIELP_TXBUF_FLUSH,
+        WMI_TLV_PDEV_PARAM_PCIELP_TXBUF_WATERMARK,
+        WMI_TLV_PDEV_PARAM_PCIELP_TXBUF_TMO_EN,
+        WMI_TLV_PDEV_PARAM_PCIELP_TXBUF_TMO_VALUE,
+        WMI_TLV_PDEV_PARAM_PDEV_STATS_UPDATE_PERIOD,
+        WMI_TLV_PDEV_PARAM_VDEV_STATS_UPDATE_PERIOD,
+        WMI_TLV_PDEV_PARAM_PEER_STATS_UPDATE_PERIOD,
+        WMI_TLV_PDEV_PARAM_BCNFLT_STATS_UPDATE_PERIOD,
+        WMI_TLV_PDEV_PARAM_PMF_QOS,
+        WMI_TLV_PDEV_PARAM_ARP_AC_OVERRIDE,
+        WMI_TLV_PDEV_PARAM_DCS,
+        WMI_TLV_PDEV_PARAM_ANI_ENABLE,
+        WMI_TLV_PDEV_PARAM_ANI_POLL_PERIOD,
+        WMI_TLV_PDEV_PARAM_ANI_LISTEN_PERIOD,
+        WMI_TLV_PDEV_PARAM_ANI_OFDM_LEVEL,
+        WMI_TLV_PDEV_PARAM_ANI_CCK_LEVEL,
+        WMI_TLV_PDEV_PARAM_DYNTXCHAIN,
+        WMI_TLV_PDEV_PARAM_PROXY_STA,
+        WMI_TLV_PDEV_PARAM_IDLE_PS_CONFIG,
+        WMI_TLV_PDEV_PARAM_POWER_GATING_SLEEP,
+        WMI_TLV_PDEV_PARAM_RFKILL_ENABLE,
+        WMI_TLV_PDEV_PARAM_BURST_DUR,
+        WMI_TLV_PDEV_PARAM_BURST_ENABLE,
+        WMI_TLV_PDEV_PARAM_HW_RFKILL_CONFIG,
+        WMI_TLV_PDEV_PARAM_LOW_POWER_RF_ENABLE,
+        WMI_TLV_PDEV_PARAM_L1SS_TRACK,
+        WMI_TLV_PDEV_PARAM_HYST_EN,
+        WMI_TLV_PDEV_PARAM_POWER_COLLAPSE_ENABLE,
+        WMI_TLV_PDEV_PARAM_LED_SYS_STATE,
+        WMI_TLV_PDEV_PARAM_LED_ENABLE,
+        WMI_TLV_PDEV_PARAM_AUDIO_OVER_WLAN_LATENCY,
+        WMI_TLV_PDEV_PARAM_AUDIO_OVER_WLAN_ENABLE,
+        WMI_TLV_PDEV_PARAM_WHAL_MIB_STATS_UPDATE_ENABLE,
+        WMI_TLV_PDEV_PARAM_VDEV_RATE_STATS_UPDATE_PERIOD,
+        WMI_TLV_PDEV_PARAM_TXPOWER_REASON_NONE,
+        WMI_TLV_PDEV_PARAM_TXPOWER_REASON_SAR,
+        WMI_TLV_PDEV_PARAM_TXPOWER_REASON_MAX,
+};
+
+enum wmi_tlv_vdev_param {
+        WMI_TLV_VDEV_PARAM_RTS_THRESHOLD = 0x1,
+        WMI_TLV_VDEV_PARAM_FRAGMENTATION_THRESHOLD,
+        WMI_TLV_VDEV_PARAM_BEACON_INTERVAL,
+        WMI_TLV_VDEV_PARAM_LISTEN_INTERVAL,
+        WMI_TLV_VDEV_PARAM_MULTICAST_RATE,
+        WMI_TLV_VDEV_PARAM_MGMT_TX_RATE,
+        WMI_TLV_VDEV_PARAM_SLOT_TIME,
+        WMI_TLV_VDEV_PARAM_PREAMBLE,
+        WMI_TLV_VDEV_PARAM_SWBA_TIME,
+        WMI_TLV_VDEV_STATS_UPDATE_PERIOD,
+        WMI_TLV_VDEV_PWRSAVE_AGEOUT_TIME,
+        WMI_TLV_VDEV_HOST_SWBA_INTERVAL,
+        WMI_TLV_VDEV_PARAM_DTIM_PERIOD,
+        WMI_TLV_VDEV_OC_SCHEDULER_AIR_TIME_LIMIT,
+        WMI_TLV_VDEV_PARAM_WDS,
+        WMI_TLV_VDEV_PARAM_ATIM_WINDOW,
+        WMI_TLV_VDEV_PARAM_BMISS_COUNT_MAX,
+        WMI_TLV_VDEV_PARAM_BMISS_FIRST_BCNT,
+        WMI_TLV_VDEV_PARAM_BMISS_FINAL_BCNT,
+        WMI_TLV_VDEV_PARAM_FEATURE_WMM,
+        WMI_TLV_VDEV_PARAM_CHWIDTH,
+        WMI_TLV_VDEV_PARAM_CHEXTOFFSET,
+        WMI_TLV_VDEV_PARAM_DISABLE_HTPROTECTION,
+        WMI_TLV_VDEV_PARAM_STA_QUICKKICKOUT,
+        WMI_TLV_VDEV_PARAM_MGMT_RATE,
+        WMI_TLV_VDEV_PARAM_PROTECTION_MODE,
+        WMI_TLV_VDEV_PARAM_FIXED_RATE,
+        WMI_TLV_VDEV_PARAM_SGI,
+        WMI_TLV_VDEV_PARAM_LDPC,
+        WMI_TLV_VDEV_PARAM_TX_STBC,
+        WMI_TLV_VDEV_PARAM_RX_STBC,
+        WMI_TLV_VDEV_PARAM_INTRA_BSS_FWD,
+        WMI_TLV_VDEV_PARAM_DEF_KEYID,
+        WMI_TLV_VDEV_PARAM_NSS,
+        WMI_TLV_VDEV_PARAM_BCAST_DATA_RATE,
+        WMI_TLV_VDEV_PARAM_MCAST_DATA_RATE,
+        WMI_TLV_VDEV_PARAM_MCAST_INDICATE,
+        WMI_TLV_VDEV_PARAM_DHCP_INDICATE,
+        WMI_TLV_VDEV_PARAM_UNKNOWN_DEST_INDICATE,
+        WMI_TLV_VDEV_PARAM_AP_KEEPALIVE_MIN_IDLE_INACTIVE_TIME_SECS,
+        WMI_TLV_VDEV_PARAM_AP_KEEPALIVE_MAX_IDLE_INACTIVE_TIME_SECS,
+        WMI_TLV_VDEV_PARAM_AP_KEEPALIVE_MAX_UNRESPONSIVE_TIME_SECS,
+        WMI_TLV_VDEV_PARAM_AP_ENABLE_NAWDS,
+        WMI_TLV_VDEV_PARAM_ENABLE_RTSCTS,
+        WMI_TLV_VDEV_PARAM_TXBF,
+        WMI_TLV_VDEV_PARAM_PACKET_POWERSAVE,
+        WMI_TLV_VDEV_PARAM_DROP_UNENCRY,
+        WMI_TLV_VDEV_PARAM_TX_ENCAP_TYPE,
+        WMI_TLV_VDEV_PARAM_AP_DETECT_OUT_OF_SYNC_SLEEPING_STA_TIME_SECS,
+        WMI_TLV_VDEV_PARAM_EARLY_RX_ADJUST_ENABLE,
+        WMI_TLV_VDEV_PARAM_EARLY_RX_TGT_BMISS_NUM,
+        WMI_TLV_VDEV_PARAM_EARLY_RX_BMISS_SAMPLE_CYCLE,
+        WMI_TLV_VDEV_PARAM_EARLY_RX_SLOP_STEP,
+        WMI_TLV_VDEV_PARAM_EARLY_RX_INIT_SLOP,
+        WMI_TLV_VDEV_PARAM_EARLY_RX_ADJUST_PAUSE,
+        WMI_TLV_VDEV_PARAM_TX_PWRLIMIT,
+        WMI_TLV_VDEV_PARAM_SNR_NUM_FOR_CAL,
+        WMI_TLV_VDEV_PARAM_ROAM_FW_OFFLOAD,
+        WMI_TLV_VDEV_PARAM_ENABLE_RMC,
+        WMI_TLV_VDEV_PARAM_IBSS_MAX_BCN_LOST_MS,
+        WMI_TLV_VDEV_PARAM_MAX_RATE,
+        WMI_TLV_VDEV_PARAM_EARLY_RX_DRIFT_SAMPLE,
+        WMI_TLV_VDEV_PARAM_SET_IBSS_TX_FAIL_CNT_THR,
+        WMI_TLV_VDEV_PARAM_EBT_RESYNC_TIMEOUT,
+        WMI_TLV_VDEV_PARAM_AGGR_TRIG_EVENT_ENABLE,
+        WMI_TLV_VDEV_PARAM_IS_IBSS_POWER_SAVE_ALLOWED,
+        WMI_TLV_VDEV_PARAM_IS_POWER_COLLAPSE_ALLOWED,
+        WMI_TLV_VDEV_PARAM_IS_AWAKE_ON_TXRX_ENABLED,
+        WMI_TLV_VDEV_PARAM_INACTIVITY_CNT,
+        WMI_TLV_VDEV_PARAM_TXSP_END_INACTIVITY_TIME_MS,
+        WMI_TLV_VDEV_PARAM_DTIM_POLICY,
+        WMI_TLV_VDEV_PARAM_IBSS_PS_WARMUP_TIME_SECS,
+        WMI_TLV_VDEV_PARAM_IBSS_PS_1RX_CHAIN_IN_ATIM_WINDOW_ENABLE,
+};
+
+enum wmi_tlv_tag {
+        WMI_TLV_TAG_LAST_RESERVED = 15,
+
+        WMI_TLV_TAG_FIRST_ARRAY_ENUM,
+        WMI_TLV_TAG_ARRAY_UINT32 = WMI_TLV_TAG_FIRST_ARRAY_ENUM,
+        WMI_TLV_TAG_ARRAY_BYTE,
+        WMI_TLV_TAG_ARRAY_STRUCT,
+        WMI_TLV_TAG_ARRAY_FIXED_STRUCT,
+        WMI_TLV_TAG_LAST_ARRAY_ENUM = 31,
+
+        WMI_TLV_TAG_STRUCT_SERVICE_READY_EVENT,
+        WMI_TLV_TAG_STRUCT_HAL_REG_CAPABILITIES,
+        WMI_TLV_TAG_STRUCT_WLAN_HOST_MEM_REQ,
+        WMI_TLV_TAG_STRUCT_READY_EVENT,
+        WMI_TLV_TAG_STRUCT_SCAN_EVENT,
+        WMI_TLV_TAG_STRUCT_PDEV_TPC_CONFIG_EVENT,
+        WMI_TLV_TAG_STRUCT_CHAN_INFO_EVENT,
+        WMI_TLV_TAG_STRUCT_COMB_PHYERR_RX_HDR,
+        WMI_TLV_TAG_STRUCT_VDEV_START_RESPONSE_EVENT,
+        WMI_TLV_TAG_STRUCT_VDEV_STOPPED_EVENT,
+        WMI_TLV_TAG_STRUCT_VDEV_INSTALL_KEY_COMPLETE_EVENT,
+        WMI_TLV_TAG_STRUCT_PEER_STA_KICKOUT_EVENT,
+        WMI_TLV_TAG_STRUCT_MGMT_RX_HDR,
+        WMI_TLV_TAG_STRUCT_TBTT_OFFSET_EVENT,
+        WMI_TLV_TAG_STRUCT_TX_DELBA_COMPLETE_EVENT,
+        WMI_TLV_TAG_STRUCT_TX_ADDBA_COMPLETE_EVENT,
+        WMI_TLV_TAG_STRUCT_ROAM_EVENT,
+        WMI_TLV_TAG_STRUCT_WOW_EVENT_INFO,
+        WMI_TLV_TAG_STRUCT_WOW_EVENT_INFO_SECTION_BITMAP,
+        WMI_TLV_TAG_STRUCT_RTT_EVENT_HEADER,
+        WMI_TLV_TAG_STRUCT_RTT_ERROR_REPORT_EVENT,
+        WMI_TLV_TAG_STRUCT_RTT_MEAS_EVENT,
+        WMI_TLV_TAG_STRUCT_ECHO_EVENT,
+        WMI_TLV_TAG_STRUCT_FTM_INTG_EVENT,
+        WMI_TLV_TAG_STRUCT_VDEV_GET_KEEPALIVE_EVENT,
+        WMI_TLV_TAG_STRUCT_GPIO_INPUT_EVENT,
+        WMI_TLV_TAG_STRUCT_CSA_EVENT,
+        WMI_TLV_TAG_STRUCT_GTK_OFFLOAD_STATUS_EVENT,
+        WMI_TLV_TAG_STRUCT_IGTK_INFO,
+        WMI_TLV_TAG_STRUCT_DCS_INTERFERENCE_EVENT,
+        WMI_TLV_TAG_STRUCT_ATH_DCS_CW_INT,
+        WMI_TLV_TAG_STRUCT_ATH_DCS_WLAN_INT_STAT,
+        WMI_TLV_TAG_STRUCT_WLAN_PROFILE_CTX_T,
+        WMI_TLV_TAG_STRUCT_WLAN_PROFILE_T,
+        WMI_TLV_TAG_STRUCT_PDEV_QVIT_EVENT,
+        WMI_TLV_TAG_STRUCT_HOST_SWBA_EVENT,
+        WMI_TLV_TAG_STRUCT_TIM_INFO,
+        WMI_TLV_TAG_STRUCT_P2P_NOA_INFO,
+        WMI_TLV_TAG_STRUCT_STATS_EVENT,
+        WMI_TLV_TAG_STRUCT_AVOID_FREQ_RANGES_EVENT,
+        WMI_TLV_TAG_STRUCT_AVOID_FREQ_RANGE_DESC,
+        WMI_TLV_TAG_STRUCT_GTK_REKEY_FAIL_EVENT,
+        WMI_TLV_TAG_STRUCT_INIT_CMD,
+        WMI_TLV_TAG_STRUCT_RESOURCE_CONFIG,
+        WMI_TLV_TAG_STRUCT_WLAN_HOST_MEMORY_CHUNK,
+        WMI_TLV_TAG_STRUCT_START_SCAN_CMD,
+        WMI_TLV_TAG_STRUCT_STOP_SCAN_CMD,
+        WMI_TLV_TAG_STRUCT_SCAN_CHAN_LIST_CMD,
+        WMI_TLV_TAG_STRUCT_CHANNEL,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_REGDOMAIN_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_PARAM_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_WMM_PARAMS_CMD,
+        WMI_TLV_TAG_STRUCT_WMM_PARAMS,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_QUIET_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_CREATE_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_DELETE_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_START_REQUEST_CMD,
+        WMI_TLV_TAG_STRUCT_P2P_NOA_DESCRIPTOR,
+        WMI_TLV_TAG_STRUCT_P2P_GO_SET_BEACON_IE,
+        WMI_TLV_TAG_STRUCT_GTK_OFFLOAD_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_UP_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_STOP_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_DOWN_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_SET_PARAM_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_INSTALL_KEY_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_CREATE_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_DELETE_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_FLUSH_TIDS_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_SET_PARAM_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_ASSOC_COMPLETE_CMD,
+        WMI_TLV_TAG_STRUCT_VHT_RATE_SET,
+        WMI_TLV_TAG_STRUCT_BCN_TMPL_CMD,
+        WMI_TLV_TAG_STRUCT_PRB_TMPL_CMD,
+        WMI_TLV_TAG_STRUCT_BCN_PRB_INFO,
+        WMI_TLV_TAG_STRUCT_PEER_TID_ADDBA_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_TID_DELBA_CMD,
+        WMI_TLV_TAG_STRUCT_STA_POWERSAVE_MODE_CMD,
+        WMI_TLV_TAG_STRUCT_STA_POWERSAVE_PARAM_CMD,
+        WMI_TLV_TAG_STRUCT_STA_DTIM_PS_METHOD_CMD,
+        WMI_TLV_TAG_STRUCT_ROAM_SCAN_MODE,
+        WMI_TLV_TAG_STRUCT_ROAM_SCAN_RSSI_THRESHOLD,
+        WMI_TLV_TAG_STRUCT_ROAM_SCAN_PERIOD,
+        WMI_TLV_TAG_STRUCT_ROAM_SCAN_RSSI_CHANGE_THRESHOLD,
+        WMI_TLV_TAG_STRUCT_PDEV_SUSPEND_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_RESUME_CMD,
+        WMI_TLV_TAG_STRUCT_ADD_BCN_FILTER_CMD,
+        WMI_TLV_TAG_STRUCT_RMV_BCN_FILTER_CMD,
+        WMI_TLV_TAG_STRUCT_WOW_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_WOW_HOSTWAKEUP_FROM_SLEEP_CMD,
+        WMI_TLV_TAG_STRUCT_STA_UAPSD_AUTO_TRIG_CMD,
+        WMI_TLV_TAG_STRUCT_STA_UAPSD_AUTO_TRIG_PARAM,
+        WMI_TLV_TAG_STRUCT_SET_ARP_NS_OFFLOAD_CMD,
+        WMI_TLV_TAG_STRUCT_ARP_OFFLOAD_TUPLE,
+        WMI_TLV_TAG_STRUCT_NS_OFFLOAD_TUPLE,
+        WMI_TLV_TAG_STRUCT_FTM_INTG_CMD,
+        WMI_TLV_TAG_STRUCT_STA_KEEPALIVE_CMD,
+        WMI_TLV_TAG_STRUCT_STA_KEEPALVE_ARP_RESPONSE,
+        WMI_TLV_TAG_STRUCT_P2P_SET_VENDOR_IE_DATA_CMD,
+        WMI_TLV_TAG_STRUCT_AP_PS_PEER_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_RATE_RETRY_SCHED_CMD,
+        WMI_TLV_TAG_STRUCT_WLAN_PROFILE_TRIGGER_CMD,
+        WMI_TLV_TAG_STRUCT_WLAN_PROFILE_SET_HIST_INTVL_CMD,
+        WMI_TLV_TAG_STRUCT_WLAN_PROFILE_GET_PROF_DATA_CMD,
+        WMI_TLV_TAG_STRUCT_WLAN_PROFILE_ENABLE_PROFILE_ID_CMD,
+        WMI_TLV_TAG_STRUCT_WOW_DEL_PATTERN_CMD,
+        WMI_TLV_TAG_STRUCT_WOW_ADD_DEL_EVT_CMD,
+        WMI_TLV_TAG_STRUCT_RTT_MEASREQ_HEAD,
+        WMI_TLV_TAG_STRUCT_RTT_MEASREQ_BODY,
+        WMI_TLV_TAG_STRUCT_RTT_TSF_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_SPECTRAL_CONFIGURE_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_SPECTRAL_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_REQUEST_STATS_CMD,
+        WMI_TLV_TAG_STRUCT_NLO_CONFIG_CMD,
+        WMI_TLV_TAG_STRUCT_NLO_CONFIGURED_PARAMETERS,
+        WMI_TLV_TAG_STRUCT_CSA_OFFLOAD_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_CSA_OFFLOAD_CHANSWITCH_CMD,
+        WMI_TLV_TAG_STRUCT_CHATTER_SET_MODE_CMD,
+        WMI_TLV_TAG_STRUCT_ECHO_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_SET_KEEPALIVE_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_GET_KEEPALIVE_CMD,
+        WMI_TLV_TAG_STRUCT_FORCE_FW_HANG_CMD,
+        WMI_TLV_TAG_STRUCT_GPIO_CONFIG_CMD,
+        WMI_TLV_TAG_STRUCT_GPIO_OUTPUT_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_ADD_WDS_ENTRY_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_REMOVE_WDS_ENTRY_CMD,
+        WMI_TLV_TAG_STRUCT_BCN_TX_HDR,
+        WMI_TLV_TAG_STRUCT_BCN_SEND_FROM_HOST_CMD,
+        WMI_TLV_TAG_STRUCT_MGMT_TX_HDR,
+        WMI_TLV_TAG_STRUCT_ADDBA_CLEAR_RESP_CMD,
+        WMI_TLV_TAG_STRUCT_ADDBA_SEND_CMD,
+        WMI_TLV_TAG_STRUCT_DELBA_SEND_CMD,
+        WMI_TLV_TAG_STRUCT_ADDBA_SETRESPONSE_CMD,
+        WMI_TLV_TAG_STRUCT_SEND_SINGLEAMSDU_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_PKTLOG_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_PKTLOG_DISABLE_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_HT_IE_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_VHT_IE_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_DSCP_TID_MAP_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_GREEN_AP_PS_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_GET_TPC_CONFIG_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_BASE_MACADDR_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_MCAST_GROUP_CMD,
+        WMI_TLV_TAG_STRUCT_ROAM_AP_PROFILE,
+        WMI_TLV_TAG_STRUCT_AP_PROFILE,
+        WMI_TLV_TAG_STRUCT_SCAN_SCH_PRIORITY_TABLE_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_DFS_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_DFS_DISABLE_CMD,
+        WMI_TLV_TAG_STRUCT_WOW_ADD_PATTERN_CMD,
+        WMI_TLV_TAG_STRUCT_WOW_BITMAP_PATTERN_T,
+        WMI_TLV_TAG_STRUCT_WOW_IPV4_SYNC_PATTERN_T,
+        WMI_TLV_TAG_STRUCT_WOW_IPV6_SYNC_PATTERN_T,
+        WMI_TLV_TAG_STRUCT_WOW_MAGIC_PATTERN_CMD,
+        WMI_TLV_TAG_STRUCT_SCAN_UPDATE_REQUEST_CMD,
+        WMI_TLV_TAG_STRUCT_CHATTER_PKT_COALESCING_FILTER,
+        WMI_TLV_TAG_STRUCT_CHATTER_COALESCING_ADD_FILTER_CMD,
+        WMI_TLV_TAG_STRUCT_CHATTER_COALESCING_DELETE_FILTER_CMD,
+        WMI_TLV_TAG_STRUCT_CHATTER_COALESCING_QUERY_CMD,
+        WMI_TLV_TAG_STRUCT_TXBF_CMD,
+        WMI_TLV_TAG_STRUCT_DEBUG_LOG_CONFIG_CMD,
+        WMI_TLV_TAG_STRUCT_NLO_EVENT,
+        WMI_TLV_TAG_STRUCT_CHATTER_QUERY_REPLY_EVENT,
+        WMI_TLV_TAG_STRUCT_UPLOAD_H_HDR,
+        WMI_TLV_TAG_STRUCT_CAPTURE_H_EVENT_HDR,
+        WMI_TLV_TAG_STRUCT_VDEV_WNM_SLEEPMODE_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_IPSEC_NATKEEPALIVE_FILTER_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_WMM_ADDTS_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_WMM_DELTS_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_SET_WMM_PARAMS_CMD,
+        WMI_TLV_TAG_STRUCT_TDLS_SET_STATE_CMD,
+        WMI_TLV_TAG_STRUCT_TDLS_PEER_UPDATE_CMD,
+        WMI_TLV_TAG_STRUCT_TDLS_PEER_EVENT,
+        WMI_TLV_TAG_STRUCT_TDLS_PEER_CAPABILITIES,
+        WMI_TLV_TAG_STRUCT_VDEV_MCC_SET_TBTT_MODE_CMD,
+        WMI_TLV_TAG_STRUCT_ROAM_CHAN_LIST,
+        WMI_TLV_TAG_STRUCT_VDEV_MCC_BCN_INTVL_CHANGE_EVENT,
+        WMI_TLV_TAG_STRUCT_RESMGR_ADAPTIVE_OCS_CMD,
+        WMI_TLV_TAG_STRUCT_RESMGR_SET_CHAN_TIME_QUOTA_CMD,
+        WMI_TLV_TAG_STRUCT_RESMGR_SET_CHAN_LATENCY_CMD,
+        WMI_TLV_TAG_STRUCT_BA_REQ_SSN_CMD,
+        WMI_TLV_TAG_STRUCT_BA_RSP_SSN_EVENT,
+        WMI_TLV_TAG_STRUCT_STA_SMPS_FORCE_MODE_CMD,
+        WMI_TLV_TAG_STRUCT_SET_MCASTBCAST_FILTER_CMD,
+        WMI_TLV_TAG_STRUCT_P2P_SET_OPPPS_CMD,
+        WMI_TLV_TAG_STRUCT_P2P_SET_NOA_CMD,
+        WMI_TLV_TAG_STRUCT_BA_REQ_SSN_CMD_SUB_STRUCT_PARAM,
+        WMI_TLV_TAG_STRUCT_BA_REQ_SSN_EVENT_SUB_STRUCT_PARAM,
+        WMI_TLV_TAG_STRUCT_STA_SMPS_PARAM_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_SET_GTX_PARAMS_CMD,
+        WMI_TLV_TAG_STRUCT_MCC_SCHED_TRAFFIC_STATS_CMD,
+        WMI_TLV_TAG_STRUCT_MCC_SCHED_STA_TRAFFIC_STATS,
+        WMI_TLV_TAG_STRUCT_OFFLOAD_BCN_TX_STATUS_EVENT,
+        WMI_TLV_TAG_STRUCT_P2P_NOA_EVENT,
+        WMI_TLV_TAG_STRUCT_HB_SET_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_HB_SET_TCP_PARAMS_CMD,
+        WMI_TLV_TAG_STRUCT_HB_SET_TCP_PKT_FILTER_CMD,
+        WMI_TLV_TAG_STRUCT_HB_SET_UDP_PARAMS_CMD,
+        WMI_TLV_TAG_STRUCT_HB_SET_UDP_PKT_FILTER_CMD,
+        WMI_TLV_TAG_STRUCT_HB_IND_EVENT,
+        WMI_TLV_TAG_STRUCT_TX_PAUSE_EVENT,
+        WMI_TLV_TAG_STRUCT_RFKILL_EVENT,
+        WMI_TLV_TAG_STRUCT_DFS_RADAR_EVENT,
+        WMI_TLV_TAG_STRUCT_DFS_PHYERR_FILTER_ENA_CMD,
+        WMI_TLV_TAG_STRUCT_DFS_PHYERR_FILTER_DIS_CMD,
+        WMI_TLV_TAG_STRUCT_BATCH_SCAN_RESULT_SCAN_LIST,
+        WMI_TLV_TAG_STRUCT_BATCH_SCAN_RESULT_NETWORK_INFO,
+        WMI_TLV_TAG_STRUCT_BATCH_SCAN_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_BATCH_SCAN_DISABLE_CMD,
+        WMI_TLV_TAG_STRUCT_BATCH_SCAN_TRIGGER_RESULT_CMD,
+        WMI_TLV_TAG_STRUCT_BATCH_SCAN_ENABLED_EVENT,
+        WMI_TLV_TAG_STRUCT_BATCH_SCAN_RESULT_EVENT,
+        WMI_TLV_TAG_STRUCT_VDEV_PLMREQ_START_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_PLMREQ_STOP_CMD,
+        WMI_TLV_TAG_STRUCT_THERMAL_MGMT_CMD,
+        WMI_TLV_TAG_STRUCT_THERMAL_MGMT_EVENT,
+        WMI_TLV_TAG_STRUCT_PEER_INFO_REQ_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_INFO_EVENT,
+        WMI_TLV_TAG_STRUCT_PEER_INFO,
+        WMI_TLV_TAG_STRUCT_PEER_TX_FAIL_CNT_THR_EVENT,
+        WMI_TLV_TAG_STRUCT_RMC_SET_MODE_CMD,
+        WMI_TLV_TAG_STRUCT_RMC_SET_ACTION_PERIOD_CMD,
+        WMI_TLV_TAG_STRUCT_RMC_CONFIG_CMD,
+        WMI_TLV_TAG_STRUCT_MHF_OFFLOAD_SET_MODE_CMD,
+        WMI_TLV_TAG_STRUCT_MHF_OFFLOAD_PLUMB_ROUTING_TABLE_CMD,
+        WMI_TLV_TAG_STRUCT_ADD_PROACTIVE_ARP_RSP_PATTERN_CMD,
+        WMI_TLV_TAG_STRUCT_DEL_PROACTIVE_ARP_RSP_PATTERN_CMD,
+        WMI_TLV_TAG_STRUCT_NAN_CMD_PARAM,
+        WMI_TLV_TAG_STRUCT_NAN_EVENT_HDR,
+        WMI_TLV_TAG_STRUCT_PDEV_L1SS_TRACK_EVENT,
+        WMI_TLV_TAG_STRUCT_DIAG_DATA_CONTAINER_EVENT,
+        WMI_TLV_TAG_STRUCT_MODEM_POWER_STATE_CMD_PARAM,
+        WMI_TLV_TAG_STRUCT_PEER_GET_ESTIMATED_LINKSPEED_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_ESTIMATED_LINKSPEED_EVENT,
+        WMI_TLV_TAG_STRUCT_AGGR_STATE_TRIG_EVENT,
+        WMI_TLV_TAG_STRUCT_MHF_OFFLOAD_ROUTING_TABLE_ENTRY,
+        WMI_TLV_TAG_STRUCT_ROAM_SCAN_CMD,
+        WMI_TLV_TAG_STRUCT_REQ_STATS_EXT_CMD,
+        WMI_TLV_TAG_STRUCT_STATS_EXT_EVENT,
+        WMI_TLV_TAG_STRUCT_OBSS_SCAN_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_OBSS_SCAN_DISABLE_CMD,
+        WMI_TLV_TAG_STRUCT_OFFLOAD_PRB_RSP_TX_STATUS_EVENT,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_LED_CONFIG_CMD,
+        WMI_TLV_TAG_STRUCT_HOST_AUTO_SHUTDOWN_CFG_CMD,
+        WMI_TLV_TAG_STRUCT_HOST_AUTO_SHUTDOWN_EVENT,
+        WMI_TLV_TAG_STRUCT_UPDATE_WHAL_MIB_STATS_EVENT,
+        WMI_TLV_TAG_STRUCT_CHAN_AVOID_UPDATE_CMD_PARAM,
+        WMI_TLV_TAG_STRUCT_WOW_ACER_IOAC_PKT_PATTERN_T,
+        WMI_TLV_TAG_STRUCT_WOW_ACER_IOAC_TMR_PATTERN_T,
+        WMI_TLV_TAG_STRUCT_WOW_IOAC_ADD_KEEPALIVE_CMD,
+        WMI_TLV_TAG_STRUCT_WOW_IOAC_DEL_KEEPALIVE_CMD,
+        WMI_TLV_TAG_STRUCT_WOW_IOAC_KEEPALIVE_T,
+        WMI_TLV_TAG_STRUCT_WOW_ACER_IOAC_ADD_PATTERN_CMD,
+        WMI_TLV_TAG_STRUCT_WOW_ACER_IOAC_DEL_PATTERN_CMD,
+        WMI_TLV_TAG_STRUCT_START_LINK_STATS_CMD,
+        WMI_TLV_TAG_STRUCT_CLEAR_LINK_STATS_CMD,
+        WMI_TLV_TAG_STRUCT_REQUEST_LINK_STATS_CMD,
+        WMI_TLV_TAG_STRUCT_IFACE_LINK_STATS_EVENT,
+        WMI_TLV_TAG_STRUCT_RADIO_LINK_STATS_EVENT,
+        WMI_TLV_TAG_STRUCT_PEER_STATS_EVENT,
+        WMI_TLV_TAG_STRUCT_CHANNEL_STATS,
+        WMI_TLV_TAG_STRUCT_RADIO_LINK_STATS,
+        WMI_TLV_TAG_STRUCT_RATE_STATS,
+        WMI_TLV_TAG_STRUCT_PEER_LINK_STATS,
+        WMI_TLV_TAG_STRUCT_WMM_AC_STATS,
+        WMI_TLV_TAG_STRUCT_IFACE_LINK_STATS,
+        WMI_TLV_TAG_STRUCT_LPI_MGMT_SNOOPING_CONFIG_CMD,
+        WMI_TLV_TAG_STRUCT_LPI_START_SCAN_CMD,
+        WMI_TLV_TAG_STRUCT_LPI_STOP_SCAN_CMD,
+        WMI_TLV_TAG_STRUCT_LPI_RESULT_EVENT,
+        WMI_TLV_TAG_STRUCT_PEER_STATE_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_BUCKET_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_BUCKET_CHANNEL_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_START_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_STOP_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_CONFIGURE_WLAN_CHANGE_MONITOR_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_WLAN_CHANGE_BSSID_PARAM_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_CONFIGURE_HOTLIST_MONITOR_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_GET_CACHED_RESULTS_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_GET_WLAN_CHANGE_RESULTS_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_SET_CAPABILITIES_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_GET_CAPABILITIES_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_OPERATION_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_START_STOP_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_TABLE_USAGE_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_WLAN_DESCRIPTOR_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_RSSI_INFO_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_CACHED_RESULTS_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_WLAN_CHANGE_RESULTS_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_WLAN_CHANGE_RESULT_BSSID_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_HOTLIST_MATCH_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_CAPABILITIES_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_CACHE_CAPABILITIES_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_WLAN_CHANGE_MONITOR_CAPABILITIES_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_HOTLIST_MONITOR_CAPABILITIES_EVENT,
+        WMI_TLV_TAG_STRUCT_D0_WOW_ENABLE_DISABLE_CMD,
+        WMI_TLV_TAG_STRUCT_D0_WOW_DISABLE_ACK_EVENT,
+        WMI_TLV_TAG_STRUCT_UNIT_TEST_CMD,
+        WMI_TLV_TAG_STRUCT_ROAM_OFFLOAD_TLV_PARAM,
+        WMI_TLV_TAG_STRUCT_ROAM_11I_OFFLOAD_TLV_PARAM,
+        WMI_TLV_TAG_STRUCT_ROAM_11R_OFFLOAD_TLV_PARAM,
+        WMI_TLV_TAG_STRUCT_ROAM_ESE_OFFLOAD_TLV_PARAM,
+        WMI_TLV_TAG_STRUCT_ROAM_SYNCH_EVENT,
+        WMI_TLV_TAG_STRUCT_ROAM_SYNCH_COMPLETE,
+        WMI_TLV_TAG_STRUCT_EXTWOW_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_EXTWOW_SET_APP_TYPE1_PARAMS_CMD,
+        WMI_TLV_TAG_STRUCT_EXTWOW_SET_APP_TYPE2_PARAMS_CMD,
+        WMI_TLV_TAG_STRUCT_LPI_STATUS_EVENT,
+        WMI_TLV_TAG_STRUCT_LPI_HANDOFF_EVENT,
+        WMI_TLV_TAG_STRUCT_VDEV_RATE_STATS_EVENT,
+        WMI_TLV_TAG_STRUCT_VDEV_RATE_HT_INFO,
+        WMI_TLV_TAG_STRUCT_RIC_REQUEST,
+        WMI_TLV_TAG_STRUCT_PDEV_GET_TEMPERATURE_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_TEMPERATURE_EVENT,
+        WMI_TLV_TAG_STRUCT_SET_DHCP_SERVER_OFFLOAD_CMD,
+        WMI_TLV_TAG_STRUCT_TPC_CHAINMASK_CONFIG_CMD,
+        WMI_TLV_TAG_STRUCT_RIC_TSPEC,
+        WMI_TLV_TAG_STRUCT_TPC_CHAINMASK_CONFIG,
+        WMI_TLV_TAG_STRUCT_IPA_OFFLOAD_CMD,
+        WMI_TLV_TAG_STRUCT_SCAN_PROB_REQ_OUI_CMD,
+        WMI_TLV_TAG_STRUCT_KEY_MATERIAL,
+        WMI_TLV_TAG_STRUCT_TDLS_SET_OFFCHAN_MODE_CMD,
+        WMI_TLV_TAG_STRUCT_SET_LED_FLASHING_CMD,
+        WMI_TLV_TAG_STRUCT_MDNS_OFFLOAD_CMD,
+        WMI_TLV_TAG_STRUCT_MDNS_SET_FQDN_CMD,
+        WMI_TLV_TAG_STRUCT_MDNS_SET_RESP_CMD,
+        WMI_TLV_TAG_STRUCT_MDNS_GET_STATS_CMD,
+        WMI_TLV_TAG_STRUCT_MDNS_STATS_EVENT,
+        WMI_TLV_TAG_STRUCT_ROAM_INVOKE_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_RESUME_EVENT,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_ANTENNA_DIVERSITY_CMD,
+        WMI_TLV_TAG_STRUCT_SAP_OFL_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_SAP_OFL_ADD_STA_EVENT,
+        WMI_TLV_TAG_STRUCT_SAP_OFL_DEL_STA_EVENT,
+        WMI_TLV_TAG_STRUCT_APFIND_CMD_PARAM,
+        WMI_TLV_TAG_STRUCT_APFIND_EVENT_HDR,
+
+        WMI_TLV_TAG_MAX
+};
+
+enum wmi_tlv_service {
+        WMI_TLV_SERVICE_BEACON_OFFLOAD = 0,
+        WMI_TLV_SERVICE_SCAN_OFFLOAD,
+        WMI_TLV_SERVICE_ROAM_SCAN_OFFLOAD,
+        WMI_TLV_SERVICE_BCN_MISS_OFFLOAD,
+        WMI_TLV_SERVICE_STA_PWRSAVE,
+        WMI_TLV_SERVICE_STA_ADVANCED_PWRSAVE,
+        WMI_TLV_SERVICE_AP_UAPSD,
+        WMI_TLV_SERVICE_AP_DFS,
+        WMI_TLV_SERVICE_11AC,
+        WMI_TLV_SERVICE_BLOCKACK,
+        WMI_TLV_SERVICE_PHYERR,
+        WMI_TLV_SERVICE_BCN_FILTER,
+        WMI_TLV_SERVICE_RTT,
+        WMI_TLV_SERVICE_WOW,
+        WMI_TLV_SERVICE_RATECTRL_CACHE,
+        WMI_TLV_SERVICE_IRAM_TIDS,
+        WMI_TLV_SERVICE_ARPNS_OFFLOAD,
+        WMI_TLV_SERVICE_NLO,
+        WMI_TLV_SERVICE_GTK_OFFLOAD,
+        WMI_TLV_SERVICE_SCAN_SCH,
+        WMI_TLV_SERVICE_CSA_OFFLOAD,
+        WMI_TLV_SERVICE_CHATTER,
+        WMI_TLV_SERVICE_COEX_FREQAVOID,
+        WMI_TLV_SERVICE_PACKET_POWER_SAVE,
+        WMI_TLV_SERVICE_FORCE_FW_HANG,
+        WMI_TLV_SERVICE_GPIO,
+        WMI_TLV_SERVICE_STA_DTIM_PS_MODULATED_DTIM,
+        WMI_TLV_SERVICE_STA_UAPSD_BASIC_AUTO_TRIG,
+        WMI_TLV_SERVICE_STA_UAPSD_VAR_AUTO_TRIG,
+        WMI_TLV_SERVICE_STA_KEEP_ALIVE,
+        WMI_TLV_SERVICE_TX_ENCAP,
+        WMI_TLV_SERVICE_AP_PS_DETECT_OUT_OF_SYNC,
+        WMI_TLV_SERVICE_EARLY_RX,
+        WMI_TLV_SERVICE_STA_SMPS,
+        WMI_TLV_SERVICE_FWTEST,
+        WMI_TLV_SERVICE_STA_WMMAC,
+        WMI_TLV_SERVICE_TDLS,
+        WMI_TLV_SERVICE_BURST,
+        WMI_TLV_SERVICE_MCC_BCN_INTERVAL_CHANGE,
+        WMI_TLV_SERVICE_ADAPTIVE_OCS,
+        WMI_TLV_SERVICE_BA_SSN_SUPPORT,
+        WMI_TLV_SERVICE_FILTER_IPSEC_NATKEEPALIVE,
+        WMI_TLV_SERVICE_WLAN_HB,
+        WMI_TLV_SERVICE_LTE_ANT_SHARE_SUPPORT,
+        WMI_TLV_SERVICE_BATCH_SCAN,
+        WMI_TLV_SERVICE_QPOWER,
+        WMI_TLV_SERVICE_PLMREQ,
+        WMI_TLV_SERVICE_THERMAL_MGMT,
+        WMI_TLV_SERVICE_RMC,
+        WMI_TLV_SERVICE_MHF_OFFLOAD,
+        WMI_TLV_SERVICE_COEX_SAR,
+        WMI_TLV_SERVICE_BCN_TXRATE_OVERRIDE,
+        WMI_TLV_SERVICE_NAN,
+        WMI_TLV_SERVICE_L1SS_STAT,
+        WMI_TLV_SERVICE_ESTIMATE_LINKSPEED,
+        WMI_TLV_SERVICE_OBSS_SCAN,
+        WMI_TLV_SERVICE_TDLS_OFFCHAN,
+        WMI_TLV_SERVICE_TDLS_UAPSD_BUFFER_STA,
+        WMI_TLV_SERVICE_TDLS_UAPSD_SLEEP_STA,
+        WMI_TLV_SERVICE_IBSS_PWRSAVE,
+        WMI_TLV_SERVICE_LPASS,
+        WMI_TLV_SERVICE_EXTSCAN,
+        WMI_TLV_SERVICE_D0WOW,
+        WMI_TLV_SERVICE_HSOFFLOAD,
+        WMI_TLV_SERVICE_ROAM_HO_OFFLOAD,
+        WMI_TLV_SERVICE_RX_FULL_REORDER,
+        WMI_TLV_SERVICE_DHCP_OFFLOAD,
+        WMI_TLV_SERVICE_STA_RX_IPA_OFFLOAD_SUPPORT,
+        WMI_TLV_SERVICE_MDNS_OFFLOAD,
+        WMI_TLV_SERVICE_SAP_AUTH_OFFLOAD,
+};
+
+#define WMI_SERVICE_IS_ENABLED(wmi_svc_bmap, svc_id, len) \
+        ((svc_id) < (len) && \
+         __le32_to_cpu((wmi_svc_bmap)[(svc_id)/(sizeof(u32))]) & \
+         BIT((svc_id)%(sizeof(u32))))
+
+#define SVCMAP(x, y, len) \
+        do { \
+                if (WMI_SERVICE_IS_ENABLED((in), (x), (len))) \
+                        __set_bit(y, out); \
+        } while (0)
+
+static inline void
+wmi_tlv_svc_map(const __le32 *in, unsigned long *out, size_t len)
+{
+        SVCMAP(WMI_TLV_SERVICE_BEACON_OFFLOAD,
+               WMI_SERVICE_BEACON_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_SCAN_OFFLOAD,
+               WMI_SERVICE_SCAN_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_ROAM_SCAN_OFFLOAD,
+               WMI_SERVICE_ROAM_SCAN_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_BCN_MISS_OFFLOAD,
+               WMI_SERVICE_BCN_MISS_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_STA_PWRSAVE,
+               WMI_SERVICE_STA_PWRSAVE, len);
+        SVCMAP(WMI_TLV_SERVICE_STA_ADVANCED_PWRSAVE,
+               WMI_SERVICE_STA_ADVANCED_PWRSAVE, len);
+        SVCMAP(WMI_TLV_SERVICE_AP_UAPSD,
+               WMI_SERVICE_AP_UAPSD, len);
+        SVCMAP(WMI_TLV_SERVICE_AP_DFS,
+               WMI_SERVICE_AP_DFS, len);
+        SVCMAP(WMI_TLV_SERVICE_11AC,
+               WMI_SERVICE_11AC, len);
+        SVCMAP(WMI_TLV_SERVICE_BLOCKACK,
+               WMI_SERVICE_BLOCKACK, len);
+        SVCMAP(WMI_TLV_SERVICE_PHYERR,
+               WMI_SERVICE_PHYERR, len);
+        SVCMAP(WMI_TLV_SERVICE_BCN_FILTER,
+               WMI_SERVICE_BCN_FILTER, len);
+        SVCMAP(WMI_TLV_SERVICE_RTT,
+               WMI_SERVICE_RTT, len);
+        SVCMAP(WMI_TLV_SERVICE_WOW,
+               WMI_SERVICE_WOW, len);
+        SVCMAP(WMI_TLV_SERVICE_RATECTRL_CACHE,
+               WMI_SERVICE_RATECTRL_CACHE, len);
+        SVCMAP(WMI_TLV_SERVICE_IRAM_TIDS,
+               WMI_SERVICE_IRAM_TIDS, len);
+        SVCMAP(WMI_TLV_SERVICE_ARPNS_OFFLOAD,
+               WMI_SERVICE_ARPNS_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_NLO,
+               WMI_SERVICE_NLO, len);
+        SVCMAP(WMI_TLV_SERVICE_GTK_OFFLOAD,
+               WMI_SERVICE_GTK_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_SCAN_SCH,
+               WMI_SERVICE_SCAN_SCH, len);
+        SVCMAP(WMI_TLV_SERVICE_CSA_OFFLOAD,
+               WMI_SERVICE_CSA_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_CHATTER,
+               WMI_SERVICE_CHATTER, len);
+        SVCMAP(WMI_TLV_SERVICE_COEX_FREQAVOID,
+               WMI_SERVICE_COEX_FREQAVOID, len);
+        SVCMAP(WMI_TLV_SERVICE_PACKET_POWER_SAVE,
+               WMI_SERVICE_PACKET_POWER_SAVE, len);
+        SVCMAP(WMI_TLV_SERVICE_FORCE_FW_HANG,
+               WMI_SERVICE_FORCE_FW_HANG, len);
+        SVCMAP(WMI_TLV_SERVICE_GPIO,
+               WMI_SERVICE_GPIO, len);
+        SVCMAP(WMI_TLV_SERVICE_STA_DTIM_PS_MODULATED_DTIM,
+               WMI_SERVICE_STA_DTIM_PS_MODULATED_DTIM, len);
+        SVCMAP(WMI_TLV_SERVICE_STA_UAPSD_BASIC_AUTO_TRIG,
+               WMI_SERVICE_STA_UAPSD_BASIC_AUTO_TRIG, len);
+        SVCMAP(WMI_TLV_SERVICE_STA_UAPSD_VAR_AUTO_TRIG,
+               WMI_SERVICE_STA_UAPSD_VAR_AUTO_TRIG, len);
+        SVCMAP(WMI_TLV_SERVICE_STA_KEEP_ALIVE,
+               WMI_SERVICE_STA_KEEP_ALIVE, len);
+        SVCMAP(WMI_TLV_SERVICE_TX_ENCAP,
+               WMI_SERVICE_TX_ENCAP, len);
+        SVCMAP(WMI_TLV_SERVICE_AP_PS_DETECT_OUT_OF_SYNC,
+               WMI_SERVICE_AP_PS_DETECT_OUT_OF_SYNC, len);
+        SVCMAP(WMI_TLV_SERVICE_EARLY_RX,
+               WMI_SERVICE_EARLY_RX, len);
+        SVCMAP(WMI_TLV_SERVICE_STA_SMPS,
+               WMI_SERVICE_STA_SMPS, len);
+        SVCMAP(WMI_TLV_SERVICE_FWTEST,
+               WMI_SERVICE_FWTEST, len);
+        SVCMAP(WMI_TLV_SERVICE_STA_WMMAC,
+               WMI_SERVICE_STA_WMMAC, len);
+        SVCMAP(WMI_TLV_SERVICE_TDLS,
+               WMI_SERVICE_TDLS, len);
+        SVCMAP(WMI_TLV_SERVICE_BURST,
+               WMI_SERVICE_BURST, len);
+        SVCMAP(WMI_TLV_SERVICE_MCC_BCN_INTERVAL_CHANGE,
+               WMI_SERVICE_MCC_BCN_INTERVAL_CHANGE, len);
+        SVCMAP(WMI_TLV_SERVICE_ADAPTIVE_OCS,
+               WMI_SERVICE_ADAPTIVE_OCS, len);
+        SVCMAP(WMI_TLV_SERVICE_BA_SSN_SUPPORT,
+               WMI_SERVICE_BA_SSN_SUPPORT, len);
+        SVCMAP(WMI_TLV_SERVICE_FILTER_IPSEC_NATKEEPALIVE,
+               WMI_SERVICE_FILTER_IPSEC_NATKEEPALIVE, len);
+        SVCMAP(WMI_TLV_SERVICE_WLAN_HB,
+               WMI_SERVICE_WLAN_HB, len);
+        SVCMAP(WMI_TLV_SERVICE_LTE_ANT_SHARE_SUPPORT,
+               WMI_SERVICE_LTE_ANT_SHARE_SUPPORT, len);
+        SVCMAP(WMI_TLV_SERVICE_BATCH_SCAN,
+               WMI_SERVICE_BATCH_SCAN, len);
+        SVCMAP(WMI_TLV_SERVICE_QPOWER,
+               WMI_SERVICE_QPOWER, len);
+        SVCMAP(WMI_TLV_SERVICE_PLMREQ,
+               WMI_SERVICE_PLMREQ, len);
+        SVCMAP(WMI_TLV_SERVICE_THERMAL_MGMT,
+               WMI_SERVICE_THERMAL_MGMT, len);
+        SVCMAP(WMI_TLV_SERVICE_RMC,
+               WMI_SERVICE_RMC, len);
+        SVCMAP(WMI_TLV_SERVICE_MHF_OFFLOAD,
+               WMI_SERVICE_MHF_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_COEX_SAR,
+               WMI_SERVICE_COEX_SAR, len);
+        SVCMAP(WMI_TLV_SERVICE_BCN_TXRATE_OVERRIDE,
+               WMI_SERVICE_BCN_TXRATE_OVERRIDE, len);
+        SVCMAP(WMI_TLV_SERVICE_NAN,
+               WMI_SERVICE_NAN, len);
+        SVCMAP(WMI_TLV_SERVICE_L1SS_STAT,
+               WMI_SERVICE_L1SS_STAT, len);
+        SVCMAP(WMI_TLV_SERVICE_ESTIMATE_LINKSPEED,
+               WMI_SERVICE_ESTIMATE_LINKSPEED, len);
+        SVCMAP(WMI_TLV_SERVICE_OBSS_SCAN,
+               WMI_SERVICE_OBSS_SCAN, len);
+        SVCMAP(WMI_TLV_SERVICE_TDLS_OFFCHAN,
+               WMI_SERVICE_TDLS_OFFCHAN, len);
+        SVCMAP(WMI_TLV_SERVICE_TDLS_UAPSD_BUFFER_STA,
+               WMI_SERVICE_TDLS_UAPSD_BUFFER_STA, len);
+        SVCMAP(WMI_TLV_SERVICE_TDLS_UAPSD_SLEEP_STA,
+               WMI_SERVICE_TDLS_UAPSD_SLEEP_STA, len);
+        SVCMAP(WMI_TLV_SERVICE_IBSS_PWRSAVE,
+               WMI_SERVICE_IBSS_PWRSAVE, len);
+        SVCMAP(WMI_TLV_SERVICE_LPASS,
+               WMI_SERVICE_LPASS, len);
+        SVCMAP(WMI_TLV_SERVICE_EXTSCAN,
+               WMI_SERVICE_EXTSCAN, len);
+        SVCMAP(WMI_TLV_SERVICE_D0WOW,
+               WMI_SERVICE_D0WOW, len);
+        SVCMAP(WMI_TLV_SERVICE_HSOFFLOAD,
+               WMI_SERVICE_HSOFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_ROAM_HO_OFFLOAD,
+               WMI_SERVICE_ROAM_HO_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_RX_FULL_REORDER,
+               WMI_SERVICE_RX_FULL_REORDER, len);
+        SVCMAP(WMI_TLV_SERVICE_DHCP_OFFLOAD,
+               WMI_SERVICE_DHCP_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_STA_RX_IPA_OFFLOAD_SUPPORT,
+               WMI_SERVICE_STA_RX_IPA_OFFLOAD_SUPPORT, len);
+        SVCMAP(WMI_TLV_SERVICE_MDNS_OFFLOAD,
+               WMI_SERVICE_MDNS_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_SAP_AUTH_OFFLOAD,
+               WMI_SERVICE_SAP_AUTH_OFFLOAD, len);
+}
+
+#undef SVCMAP
+
+struct wmi_tlv {
+        __le16 len;
+        __le16 tag;
+        u8 value[0];
+} __packed;
+
+#define WMI_TLV_MGMT_RX_NUM_RSSI 4
+
+struct wmi_tlv_mgmt_rx_ev {
+        __le32 channel;
+        __le32 snr;
+        __le32 rate;
+        __le32 phy_mode;
+        __le32 buf_len;
+        __le32 status;
+        __le32 rssi[WMI_TLV_MGMT_RX_NUM_RSSI];
+} __packed;
+
+struct wmi_tlv_abi_version {
+        __le32 abi_ver0;
+        __le32 abi_ver1;
+        __le32 abi_ver_ns0;
+        __le32 abi_ver_ns1;
+        __le32 abi_ver_ns2;
+        __le32 abi_ver_ns3;
+} __packed;
+
+enum wmi_tlv_hw_bd_id {
+        WMI_TLV_HW_BD_LEGACY = 0,
+        WMI_TLV_HW_BD_QCA6174 = 1,
+        WMI_TLV_HW_BD_QCA2582 = 2,
+};
+
+struct wmi_tlv_hw_bd_info {
+        u8 rev;
+        u8 project_id;
+        u8 custom_id;
+        u8 reference_design_id;
+} __packed;
+
+struct wmi_tlv_svc_rdy_ev {
+        __le32 fw_build_vers;
+        struct wmi_tlv_abi_version abi;
+        __le32 phy_capability;
+        __le32 max_frag_entry;
+        __le32 num_rf_chains;
+        __le32 ht_cap_info;
+        __le32 vht_cap_info;
+        __le32 vht_supp_mcs;
+        __le32 hw_min_tx_power;
+        __le32 hw_max_tx_power;
+        __le32 sys_cap_info;
+        __le32 min_pkt_size_enable;
+        __le32 max_bcn_ie_size;
+        __le32 num_mem_reqs;
+        __le32 max_num_scan_chans;
+        __le32 hw_bd_id; /* 0 means hw_bd_info is invalid */
+        struct wmi_tlv_hw_bd_info hw_bd_info[5];
+} __packed;
+
+struct wmi_tlv_rdy_ev {
+        struct wmi_tlv_abi_version abi;
+        struct wmi_mac_addr mac_addr;
+        __le32 status;
+} __packed;
+
+struct wmi_tlv_resource_config {
+        __le32 num_vdevs;
+        __le32 num_peers;
+        __le32 num_offload_peers;
+        __le32 num_offload_reorder_bufs;
+        __le32 num_peer_keys;
+        __le32 num_tids;
+        __le32 ast_skid_limit;
+        __le32 tx_chain_mask;
+        __le32 rx_chain_mask;
+        __le32 rx_timeout_pri[4];
+        __le32 rx_decap_mode;
+        __le32 scan_max_pending_reqs;
+        __le32 bmiss_offload_max_vdev;
+        __le32 roam_offload_max_vdev;
+        __le32 roam_offload_max_ap_profiles;
+        __le32 num_mcast_groups;
+        __le32 num_mcast_table_elems;
+        __le32 mcast2ucast_mode;
+        __le32 tx_dbg_log_size;
+        __le32 num_wds_entries;
+        __le32 dma_burst_size;
+        __le32 mac_aggr_delim;
+        __le32 rx_skip_defrag_timeout_dup_detection_check;
+        __le32 vow_config;
+        __le32 gtk_offload_max_vdev;
+        __le32 num_msdu_desc;
+        __le32 max_frag_entries;
+        __le32 num_tdls_vdevs;
+        __le32 num_tdls_conn_table_entries;
+        __le32 beacon_tx_offload_max_vdev;
+        __le32 num_multicast_filter_entries;
+        __le32 num_wow_filters;
+        __le32 num_keep_alive_pattern;
+        __le32 keep_alive_pattern_size;
+        __le32 max_tdls_concurrent_sleep_sta;
+        __le32 max_tdls_concurrent_buffer_sta;
+} __packed;
+
+struct wmi_tlv_init_cmd {
+        struct wmi_tlv_abi_version abi;
+        __le32 num_host_mem_chunks;
+} __packed;
+
+struct wmi_tlv_pdev_set_param_cmd {
+        __le32 pdev_id; /* not used yet */
+        __le32 param_id;
+        __le32 param_value;
+} __packed;
+
+struct wmi_tlv_pdev_set_rd_cmd {
+        __le32 pdev_id; /* not used yet */
+        __le32 regd;
+        __le32 regd_2ghz;
+        __le32 regd_5ghz;
+        __le32 conform_limit_2ghz;
+        __le32 conform_limit_5ghz;
+} __packed;
+
+struct wmi_tlv_scan_chan_list_cmd {
+        __le32 num_scan_chans;
+} __packed;
+
+struct wmi_tlv_start_scan_cmd {
+        struct wmi_start_scan_common common;
+        __le32 burst_duration_ms;
+        __le32 num_channels;
+        __le32 num_bssids;
+        __le32 num_ssids;
+        __le32 ie_len;
+        __le32 num_probes;
+} __packed;
+
+struct wmi_tlv_vdev_start_cmd {
+        __le32 vdev_id;
+        __le32 requestor_id;
+        __le32 bcn_intval;
+        __le32 dtim_period;
+        __le32 flags;
+        struct wmi_ssid ssid;
+        __le32 bcn_tx_rate;
+        __le32 bcn_tx_power;
+        __le32 num_noa_descr;
+        __le32 disable_hw_ack;
+} __packed;
+
+enum {
+        WMI_TLV_PEER_TYPE_DEFAULT = 0, /* generic / non-BSS / self-peer */
+        WMI_TLV_PEER_TYPE_BSS = 1,
+        WMI_TLV_PEER_TYPE_TDLS = 2,
+        WMI_TLV_PEER_TYPE_HOST_MAX = 127,
+        WMI_TLV_PEER_TYPE_ROAMOFFLOAD_TMP = 128,
+};
+
+struct wmi_tlv_peer_create_cmd {
+        __le32 vdev_id;
+        struct wmi_mac_addr peer_addr;
+        __le32 peer_type;
+} __packed;
+
+struct wmi_tlv_peer_assoc_cmd {
+        struct wmi_mac_addr mac_addr;
+        __le32 vdev_id;
+        __le32 new_assoc;
+        __le32 assoc_id;
+        __le32 flags;
+        __le32 caps;
+        __le32 listen_intval;
+        __le32 ht_caps;
+        __le32 max_mpdu;
+        __le32 mpdu_density;
+        __le32 rate_caps;
+        __le32 nss;
+        __le32 vht_caps;
+        __le32 phy_mode;
+        __le32 ht_info[2];
+        __le32 num_legacy_rates;
+        __le32 num_ht_rates;
+} __packed;
+
+struct wmi_tlv_pdev_suspend {
+        __le32 pdev_id; /* not used yet */
+        __le32 opt;
+} __packed;
+
+struct wmi_tlv_pdev_set_wmm_cmd {
+        __le32 pdev_id; /* not used yet */
+        __le32 dg_type; /* no idea.. */
+} __packed;
+
+struct wmi_tlv_vdev_set_wmm_cmd {
+        __le32 vdev_id;
+} __packed;
+
+struct wmi_tlv_phyerr_ev {
+        __le32 num_phyerrs;
+        __le32 tsf_l32;
+        __le32 tsf_u32;
+        __le32 buf_len;
+} __packed;
+
+enum wmi_tlv_dbglog_param {
+        WMI_TLV_DBGLOG_PARAM_LOG_LEVEL = 1,
+        WMI_TLV_DBGLOG_PARAM_VDEV_ENABLE,
+        WMI_TLV_DBGLOG_PARAM_VDEV_DISABLE,
+        WMI_TLV_DBGLOG_PARAM_VDEV_ENABLE_BITMAP,
+        WMI_TLV_DBGLOG_PARAM_VDEV_DISABLE_BITMAP,
+};
+
+enum wmi_tlv_dbglog_log_level {
+        WMI_TLV_DBGLOG_LOG_LEVEL_VERBOSE = 0,
+        WMI_TLV_DBGLOG_LOG_LEVEL_INFO,
+        WMI_TLV_DBGLOG_LOG_LEVEL_INFO_LVL_1,
+        WMI_TLV_DBGLOG_LOG_LEVEL_INFO_LVL_2,
+        WMI_TLV_DBGLOG_LOG_LEVEL_WARN,
+        WMI_TLV_DBGLOG_LOG_LEVEL_ERR,
+};
+
+#define WMI_TLV_DBGLOG_BITMAP_MAX_IDS 512
+#define WMI_TLV_DBGLOG_BITMAP_MAX_WORDS (WMI_TLV_DBGLOG_BITMAP_MAX_IDS / \
+                                         sizeof(__le32))
+#define WMI_TLV_DBGLOG_ALL_MODULES 0xffff
+#define WMI_TLV_DBGLOG_LOG_LEVEL_VALUE(module_id, log_level) \
+                (((module_id << 16) & 0xffff0000) | \
+                 ((log_level <<  0) & 0x000000ff))
+
+struct wmi_tlv_dbglog_cmd {
+        __le32 param;
+        __le32 value;
+} __packed;
+
+struct wmi_tlv_resume_cmd {
+        __le32 reserved;
+} __packed;
+
+struct wmi_tlv_req_stats_cmd {
+        __le32 stats_id; /* wmi_stats_id */
+        __le32 vdev_id;
+        struct wmi_mac_addr peer_macaddr;
+} __packed;
+
+struct wmi_tlv_vdev_stats {
+        __le32 vdev_id;
+        __le32 beacon_snr;
+        __le32 data_snr;
+        __le32 num_tx_frames[4]; /* per-AC */
+        __le32 num_rx_frames;
+        __le32 num_tx_frames_retries[4];
+        __le32 num_tx_frames_failures[4];
+        __le32 num_rts_fail;
+        __le32 num_rts_success;
+        __le32 num_rx_err;
+        __le32 num_rx_discard;
+        __le32 num_tx_not_acked;
+        __le32 tx_rate_history[10];
+        __le32 beacon_rssi_history[10];
+} __packed;
+
+struct wmi_tlv_pktlog_enable {
+        __le32 reserved;
+        __le32 filter;
+} __packed;
+
+struct wmi_tlv_pktlog_disable {
+        __le32 reserved;
+} __packed;
+
+enum wmi_tlv_bcn_tx_status {
+        WMI_TLV_BCN_TX_STATUS_OK,
+        WMI_TLV_BCN_TX_STATUS_XRETRY,
+        WMI_TLV_BCN_TX_STATUS_DROP,
+        WMI_TLV_BCN_TX_STATUS_FILTERED,
+};
+
+struct wmi_tlv_bcn_tx_status_ev {
+        __le32 vdev_id;
+        __le32 tx_status;
+} __packed;
+
+struct wmi_tlv_bcn_prb_info {
+        __le32 caps;
+        __le32 erp;
+        u8 ies[0];
+} __packed;
+
+struct wmi_tlv_bcn_tmpl_cmd {
+        __le32 vdev_id;
+        __le32 tim_ie_offset;
+        __le32 buf_len;
+} __packed;
+
+struct wmi_tlv_prb_tmpl_cmd {
+        __le32 vdev_id;
+        __le32 buf_len;
+} __packed;
+
+struct wmi_tlv_p2p_go_bcn_ie {
+        __le32 vdev_id;
+        __le32 ie_len;
+} __packed;
+
+enum wmi_tlv_diag_item_type {
+        WMI_TLV_DIAG_ITEM_TYPE_FW_EVENT,
+        WMI_TLV_DIAG_ITEM_TYPE_FW_LOG,
+        WMI_TLV_DIAG_ITEM_TYPE_FW_DEBUG_MSG,
+};
+
+struct wmi_tlv_diag_item {
+        u8 type;
+        u8 reserved;
+        __le16 len;
+        __le32 timestamp;
+        __le32 code;
+        u8 payload[0];
+} __packed;
+
+struct wmi_tlv_diag_data_ev {
+        __le32 num_items;
+} __packed;
+
+struct wmi_tlv_sta_keepalive_cmd {
+        __le32 vdev_id;
+        __le32 enabled;
+        __le32 method; /* WMI_STA_KEEPALIVE_METHOD_ */
+        __le32 interval; /* in seconds */
+} __packed;
+
+void ath10k_wmi_tlv_attach(struct ath10k *ar);
+
+#endif
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index c0f3e4d09263..aeea1c793943 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -22,8 +22,10 @@
 #include "htc.h"
 #include "debug.h"
 #include "wmi.h"
+#include "wmi-tlv.h"
 #include "mac.h"
 #include "testmode.h"
+#include "wmi-ops.h"
 
 /* MAIN WMI cmd track */
 static struct wmi_cmd_map wmi_cmd_map = {
@@ -143,6 +145,7 @@ static struct wmi_cmd_map wmi_cmd_map = {
         .force_fw_hang_cmdid = WMI_FORCE_FW_HANG_CMDID,
         .gpio_config_cmdid = WMI_GPIO_CONFIG_CMDID,
         .gpio_output_cmdid = WMI_GPIO_OUTPUT_CMDID,
+        .pdev_get_temperature_cmdid = WMI_CMD_UNSUPPORTED,
 };
 
 /* 10.X WMI cmd track */
@@ -265,6 +268,129 @@ static struct wmi_cmd_map wmi_10x_cmd_map = {
         .force_fw_hang_cmdid = WMI_CMD_UNSUPPORTED,
         .gpio_config_cmdid = WMI_10X_GPIO_CONFIG_CMDID,
         .gpio_output_cmdid = WMI_10X_GPIO_OUTPUT_CMDID,
+        .pdev_get_temperature_cmdid = WMI_CMD_UNSUPPORTED,
+};
+
+/* 10.2.4 WMI cmd track */
+static struct wmi_cmd_map wmi_10_2_4_cmd_map = {
+        .init_cmdid = WMI_10_2_INIT_CMDID,
+        .start_scan_cmdid = WMI_10_2_START_SCAN_CMDID,
+        .stop_scan_cmdid = WMI_10_2_STOP_SCAN_CMDID,
+        .scan_chan_list_cmdid = WMI_10_2_SCAN_CHAN_LIST_CMDID,
+        .scan_sch_prio_tbl_cmdid = WMI_CMD_UNSUPPORTED,
+        .pdev_set_regdomain_cmdid = WMI_10_2_PDEV_SET_REGDOMAIN_CMDID,
+        .pdev_set_channel_cmdid = WMI_10_2_PDEV_SET_CHANNEL_CMDID,
+        .pdev_set_param_cmdid = WMI_10_2_PDEV_SET_PARAM_CMDID,
+        .pdev_pktlog_enable_cmdid = WMI_10_2_PDEV_PKTLOG_ENABLE_CMDID,
+        .pdev_pktlog_disable_cmdid = WMI_10_2_PDEV_PKTLOG_DISABLE_CMDID,
+        .pdev_set_wmm_params_cmdid = WMI_10_2_PDEV_SET_WMM_PARAMS_CMDID,
+        .pdev_set_ht_cap_ie_cmdid = WMI_10_2_PDEV_SET_HT_CAP_IE_CMDID,
+        .pdev_set_vht_cap_ie_cmdid = WMI_10_2_PDEV_SET_VHT_CAP_IE_CMDID,
+        .pdev_set_quiet_mode_cmdid = WMI_10_2_PDEV_SET_QUIET_MODE_CMDID,
+        .pdev_green_ap_ps_enable_cmdid = WMI_10_2_PDEV_GREEN_AP_PS_ENABLE_CMDID,
+        .pdev_get_tpc_config_cmdid = WMI_10_2_PDEV_GET_TPC_CONFIG_CMDID,
+        .pdev_set_base_macaddr_cmdid = WMI_10_2_PDEV_SET_BASE_MACADDR_CMDID,
+        .vdev_create_cmdid = WMI_10_2_VDEV_CREATE_CMDID,
+        .vdev_delete_cmdid = WMI_10_2_VDEV_DELETE_CMDID,
+        .vdev_start_request_cmdid = WMI_10_2_VDEV_START_REQUEST_CMDID,
+        .vdev_restart_request_cmdid = WMI_10_2_VDEV_RESTART_REQUEST_CMDID,
+        .vdev_up_cmdid = WMI_10_2_VDEV_UP_CMDID,
+        .vdev_stop_cmdid = WMI_10_2_VDEV_STOP_CMDID,
+        .vdev_down_cmdid = WMI_10_2_VDEV_DOWN_CMDID,
+        .vdev_set_param_cmdid = WMI_10_2_VDEV_SET_PARAM_CMDID,
+        .vdev_install_key_cmdid = WMI_10_2_VDEV_INSTALL_KEY_CMDID,
+        .peer_create_cmdid = WMI_10_2_PEER_CREATE_CMDID,
+        .peer_delete_cmdid = WMI_10_2_PEER_DELETE_CMDID,
+        .peer_flush_tids_cmdid = WMI_10_2_PEER_FLUSH_TIDS_CMDID,
+        .peer_set_param_cmdid = WMI_10_2_PEER_SET_PARAM_CMDID,
+        .peer_assoc_cmdid = WMI_10_2_PEER_ASSOC_CMDID,
+        .peer_add_wds_entry_cmdid = WMI_10_2_PEER_ADD_WDS_ENTRY_CMDID,
+        .peer_remove_wds_entry_cmdid = WMI_10_2_PEER_REMOVE_WDS_ENTRY_CMDID,
+        .peer_mcast_group_cmdid = WMI_10_2_PEER_MCAST_GROUP_CMDID,
+        .bcn_tx_cmdid = WMI_10_2_BCN_TX_CMDID,
+        .pdev_send_bcn_cmdid = WMI_10_2_PDEV_SEND_BCN_CMDID,
+        .bcn_tmpl_cmdid = WMI_CMD_UNSUPPORTED,
+        .bcn_filter_rx_cmdid = WMI_10_2_BCN_FILTER_RX_CMDID,
+        .prb_req_filter_rx_cmdid = WMI_10_2_PRB_REQ_FILTER_RX_CMDID,
+        .mgmt_tx_cmdid = WMI_10_2_MGMT_TX_CMDID,
+        .prb_tmpl_cmdid = WMI_CMD_UNSUPPORTED,
+        .addba_clear_resp_cmdid = WMI_10_2_ADDBA_CLEAR_RESP_CMDID,
+        .addba_send_cmdid = WMI_10_2_ADDBA_SEND_CMDID,
+        .addba_status_cmdid = WMI_10_2_ADDBA_STATUS_CMDID,
+        .delba_send_cmdid = WMI_10_2_DELBA_SEND_CMDID,
+        .addba_set_resp_cmdid = WMI_10_2_ADDBA_SET_RESP_CMDID,
+        .send_singleamsdu_cmdid = WMI_10_2_SEND_SINGLEAMSDU_CMDID,
+        .sta_powersave_mode_cmdid = WMI_10_2_STA_POWERSAVE_MODE_CMDID,
+        .sta_powersave_param_cmdid = WMI_10_2_STA_POWERSAVE_PARAM_CMDID,
+        .sta_mimo_ps_mode_cmdid = WMI_10_2_STA_MIMO_PS_MODE_CMDID,
+        .pdev_dfs_enable_cmdid = WMI_10_2_PDEV_DFS_ENABLE_CMDID,
+        .pdev_dfs_disable_cmdid = WMI_10_2_PDEV_DFS_DISABLE_CMDID,
+        .roam_scan_mode = WMI_10_2_ROAM_SCAN_MODE,
+        .roam_scan_rssi_threshold = WMI_10_2_ROAM_SCAN_RSSI_THRESHOLD,
+        .roam_scan_period = WMI_10_2_ROAM_SCAN_PERIOD,
+        .roam_scan_rssi_change_threshold =
+                                WMI_10_2_ROAM_SCAN_RSSI_CHANGE_THRESHOLD,
+        .roam_ap_profile = WMI_10_2_ROAM_AP_PROFILE,
+        .ofl_scan_add_ap_profile = WMI_10_2_OFL_SCAN_ADD_AP_PROFILE,
+        .ofl_scan_remove_ap_profile = WMI_10_2_OFL_SCAN_REMOVE_AP_PROFILE,
+        .ofl_scan_period = WMI_10_2_OFL_SCAN_PERIOD,
+        .p2p_dev_set_device_info = WMI_10_2_P2P_DEV_SET_DEVICE_INFO,
+        .p2p_dev_set_discoverability = WMI_10_2_P2P_DEV_SET_DISCOVERABILITY,
+        .p2p_go_set_beacon_ie = WMI_10_2_P2P_GO_SET_BEACON_IE,
+        .p2p_go_set_probe_resp_ie = WMI_10_2_P2P_GO_SET_PROBE_RESP_IE,
+        .p2p_set_vendor_ie_data_cmdid = WMI_CMD_UNSUPPORTED,
+        .ap_ps_peer_param_cmdid = WMI_10_2_AP_PS_PEER_PARAM_CMDID,
+        .ap_ps_peer_uapsd_coex_cmdid = WMI_CMD_UNSUPPORTED,
+        .peer_rate_retry_sched_cmdid = WMI_10_2_PEER_RATE_RETRY_SCHED_CMDID,
+        .wlan_profile_trigger_cmdid = WMI_10_2_WLAN_PROFILE_TRIGGER_CMDID,
+        .wlan_profile_set_hist_intvl_cmdid =
+                                WMI_10_2_WLAN_PROFILE_SET_HIST_INTVL_CMDID,
+        .wlan_profile_get_profile_data_cmdid =
+                                WMI_10_2_WLAN_PROFILE_GET_PROFILE_DATA_CMDID,
+        .wlan_profile_enable_profile_id_cmdid =
+                                WMI_10_2_WLAN_PROFILE_ENABLE_PROFILE_ID_CMDID,
+        .wlan_profile_list_profile_id_cmdid =
+                                WMI_10_2_WLAN_PROFILE_LIST_PROFILE_ID_CMDID,
+        .pdev_suspend_cmdid = WMI_10_2_PDEV_SUSPEND_CMDID,
+        .pdev_resume_cmdid = WMI_10_2_PDEV_RESUME_CMDID,
+        .add_bcn_filter_cmdid = WMI_10_2_ADD_BCN_FILTER_CMDID,
+        .rmv_bcn_filter_cmdid = WMI_10_2_RMV_BCN_FILTER_CMDID,
+        .wow_add_wake_pattern_cmdid = WMI_10_2_WOW_ADD_WAKE_PATTERN_CMDID,
+        .wow_del_wake_pattern_cmdid = WMI_10_2_WOW_DEL_WAKE_PATTERN_CMDID,
+        .wow_enable_disable_wake_event_cmdid =
+                                WMI_10_2_WOW_ENABLE_DISABLE_WAKE_EVENT_CMDID,
+        .wow_enable_cmdid = WMI_10_2_WOW_ENABLE_CMDID,
+        .wow_hostwakeup_from_sleep_cmdid =
+                                WMI_10_2_WOW_HOSTWAKEUP_FROM_SLEEP_CMDID,
+        .rtt_measreq_cmdid = WMI_10_2_RTT_MEASREQ_CMDID,
+        .rtt_tsf_cmdid = WMI_10_2_RTT_TSF_CMDID,
+        .vdev_spectral_scan_configure_cmdid =
+                                WMI_10_2_VDEV_SPECTRAL_SCAN_CONFIGURE_CMDID,
+        .vdev_spectral_scan_enable_cmdid =
+                                WMI_10_2_VDEV_SPECTRAL_SCAN_ENABLE_CMDID,
+        .request_stats_cmdid = WMI_10_2_REQUEST_STATS_CMDID,
+        .set_arp_ns_offload_cmdid = WMI_CMD_UNSUPPORTED,
+        .network_list_offload_config_cmdid = WMI_CMD_UNSUPPORTED,
+        .gtk_offload_cmdid = WMI_CMD_UNSUPPORTED,
+        .csa_offload_enable_cmdid = WMI_CMD_UNSUPPORTED,
+        .csa_offload_chanswitch_cmdid = WMI_CMD_UNSUPPORTED,
+        .chatter_set_mode_cmdid = WMI_CMD_UNSUPPORTED,
+        .peer_tid_addba_cmdid = WMI_CMD_UNSUPPORTED,
+        .peer_tid_delba_cmdid = WMI_CMD_UNSUPPORTED,
+        .sta_dtim_ps_method_cmdid = WMI_CMD_UNSUPPORTED,
+        .sta_uapsd_auto_trig_cmdid = WMI_CMD_UNSUPPORTED,
+        .sta_keepalive_cmd = WMI_CMD_UNSUPPORTED,
+        .echo_cmdid = WMI_10_2_ECHO_CMDID,
+        .pdev_utf_cmdid = WMI_10_2_PDEV_UTF_CMDID,
+        .dbglog_cfg_cmdid = WMI_10_2_DBGLOG_CFG_CMDID,
+        .pdev_qvit_cmdid = WMI_10_2_PDEV_QVIT_CMDID,
+        .pdev_ftm_intg_cmdid = WMI_CMD_UNSUPPORTED,
+        .vdev_set_keepalive_cmdid = WMI_CMD_UNSUPPORTED,
+        .vdev_get_keepalive_cmdid = WMI_CMD_UNSUPPORTED,
+        .force_fw_hang_cmdid = WMI_CMD_UNSUPPORTED,
+        .gpio_config_cmdid = WMI_10_2_GPIO_CONFIG_CMDID,
+        .gpio_output_cmdid = WMI_10_2_GPIO_OUTPUT_CMDID,
+        .pdev_get_temperature_cmdid = WMI_10_2_PDEV_GET_TEMPERATURE_CMDID,
 };
 
 /* MAIN WMI VDEV param map */
@@ -385,6 +511,64 @@ static struct wmi_vdev_param_map wmi_10x_vdev_param_map = {
                 WMI_10X_VDEV_PARAM_AP_DETECT_OUT_OF_SYNC_SLEEPING_STA_TIME_SECS,
 };
 
+static struct wmi_vdev_param_map wmi_10_2_4_vdev_param_map = {
+        .rts_threshold = WMI_10X_VDEV_PARAM_RTS_THRESHOLD,
+        .fragmentation_threshold = WMI_10X_VDEV_PARAM_FRAGMENTATION_THRESHOLD,
+        .beacon_interval = WMI_10X_VDEV_PARAM_BEACON_INTERVAL,
+        .listen_interval = WMI_10X_VDEV_PARAM_LISTEN_INTERVAL,
+        .multicast_rate = WMI_10X_VDEV_PARAM_MULTICAST_RATE,
+        .mgmt_tx_rate = WMI_10X_VDEV_PARAM_MGMT_TX_RATE,
+        .slot_time = WMI_10X_VDEV_PARAM_SLOT_TIME,
+        .preamble = WMI_10X_VDEV_PARAM_PREAMBLE,
+        .swba_time = WMI_10X_VDEV_PARAM_SWBA_TIME,
+        .wmi_vdev_stats_update_period = WMI_10X_VDEV_STATS_UPDATE_PERIOD,
+        .wmi_vdev_pwrsave_ageout_time = WMI_10X_VDEV_PWRSAVE_AGEOUT_TIME,
+        .wmi_vdev_host_swba_interval = WMI_10X_VDEV_HOST_SWBA_INTERVAL,
+        .dtim_period = WMI_10X_VDEV_PARAM_DTIM_PERIOD,
+        .wmi_vdev_oc_scheduler_air_time_limit =
+                                WMI_10X_VDEV_OC_SCHEDULER_AIR_TIME_LIMIT,
+        .wds = WMI_10X_VDEV_PARAM_WDS,
+        .atim_window = WMI_10X_VDEV_PARAM_ATIM_WINDOW,
+        .bmiss_count_max = WMI_10X_VDEV_PARAM_BMISS_COUNT_MAX,
+        .bmiss_first_bcnt = WMI_VDEV_PARAM_UNSUPPORTED,
+        .bmiss_final_bcnt = WMI_VDEV_PARAM_UNSUPPORTED,
+        .feature_wmm = WMI_10X_VDEV_PARAM_FEATURE_WMM,
+        .chwidth = WMI_10X_VDEV_PARAM_CHWIDTH,
+        .chextoffset = WMI_10X_VDEV_PARAM_CHEXTOFFSET,
+        .disable_htprotection = WMI_10X_VDEV_PARAM_DISABLE_HTPROTECTION,
+        .sta_quickkickout = WMI_10X_VDEV_PARAM_STA_QUICKKICKOUT,
+        .mgmt_rate = WMI_10X_VDEV_PARAM_MGMT_RATE,
+        .protection_mode = WMI_10X_VDEV_PARAM_PROTECTION_MODE,
+        .fixed_rate = WMI_10X_VDEV_PARAM_FIXED_RATE,
+        .sgi = WMI_10X_VDEV_PARAM_SGI,
+        .ldpc = WMI_10X_VDEV_PARAM_LDPC,
+        .tx_stbc = WMI_10X_VDEV_PARAM_TX_STBC,
+        .rx_stbc = WMI_10X_VDEV_PARAM_RX_STBC,
+        .intra_bss_fwd = WMI_10X_VDEV_PARAM_INTRA_BSS_FWD,
+        .def_keyid = WMI_10X_VDEV_PARAM_DEF_KEYID,
+        .nss = WMI_10X_VDEV_PARAM_NSS,
+        .bcast_data_rate = WMI_10X_VDEV_PARAM_BCAST_DATA_RATE,
+        .mcast_data_rate = WMI_10X_VDEV_PARAM_MCAST_DATA_RATE,
+        .mcast_indicate = WMI_10X_VDEV_PARAM_MCAST_INDICATE,
+        .dhcp_indicate = WMI_10X_VDEV_PARAM_DHCP_INDICATE,
+        .unknown_dest_indicate = WMI_10X_VDEV_PARAM_UNKNOWN_DEST_INDICATE,
+        .ap_keepalive_min_idle_inactive_time_secs =
+                WMI_10X_VDEV_PARAM_AP_KEEPALIVE_MIN_IDLE_INACTIVE_TIME_SECS,
+        .ap_keepalive_max_idle_inactive_time_secs =
+                WMI_10X_VDEV_PARAM_AP_KEEPALIVE_MAX_IDLE_INACTIVE_TIME_SECS,
+        .ap_keepalive_max_unresponsive_time_secs =
+                WMI_10X_VDEV_PARAM_AP_KEEPALIVE_MAX_UNRESPONSIVE_TIME_SECS,
+        .ap_enable_nawds = WMI_10X_VDEV_PARAM_AP_ENABLE_NAWDS,
+        .mcast2ucast_set = WMI_10X_VDEV_PARAM_MCAST2UCAST_SET,
+        .enable_rtscts = WMI_10X_VDEV_PARAM_ENABLE_RTSCTS,
+        .txbf = WMI_VDEV_PARAM_UNSUPPORTED,
+        .packet_powersave = WMI_VDEV_PARAM_UNSUPPORTED,
+        .drop_unencry = WMI_VDEV_PARAM_UNSUPPORTED,
+        .tx_encap_type = WMI_VDEV_PARAM_UNSUPPORTED,
+        .ap_detect_out_of_sync_sleeping_sta_time_secs =
+                WMI_10X_VDEV_PARAM_AP_DETECT_OUT_OF_SYNC_SLEEPING_STA_TIME_SECS,
+};
+
 static struct wmi_pdev_param_map wmi_pdev_param_map = {
         .tx_chain_mask = WMI_PDEV_PARAM_TX_CHAIN_MASK,
         .rx_chain_mask = WMI_PDEV_PARAM_RX_CHAIN_MASK,
@@ -434,6 +618,7 @@ static struct wmi_pdev_param_map wmi_pdev_param_map = {
         .fast_channel_reset = WMI_PDEV_PARAM_UNSUPPORTED,
         .burst_dur = WMI_PDEV_PARAM_UNSUPPORTED,
         .burst_enable = WMI_PDEV_PARAM_UNSUPPORTED,
+        .cal_period = WMI_PDEV_PARAM_UNSUPPORTED,
 };
 
 static struct wmi_pdev_param_map wmi_10x_pdev_param_map = {
@@ -486,6 +671,60 @@ static struct wmi_pdev_param_map wmi_10x_pdev_param_map = {
         .fast_channel_reset = WMI_10X_PDEV_PARAM_FAST_CHANNEL_RESET,
         .burst_dur = WMI_10X_PDEV_PARAM_BURST_DUR,
         .burst_enable = WMI_10X_PDEV_PARAM_BURST_ENABLE,
+        .cal_period = WMI_10X_PDEV_PARAM_CAL_PERIOD,
+};
+
+static struct wmi_pdev_param_map wmi_10_2_4_pdev_param_map = {
+        .tx_chain_mask = WMI_10X_PDEV_PARAM_TX_CHAIN_MASK,
+        .rx_chain_mask = WMI_10X_PDEV_PARAM_RX_CHAIN_MASK,
+        .txpower_limit2g = WMI_10X_PDEV_PARAM_TXPOWER_LIMIT2G,
+        .txpower_limit5g = WMI_10X_PDEV_PARAM_TXPOWER_LIMIT5G,
+        .txpower_scale = WMI_10X_PDEV_PARAM_TXPOWER_SCALE,
+        .beacon_gen_mode = WMI_10X_PDEV_PARAM_BEACON_GEN_MODE,
+        .beacon_tx_mode = WMI_10X_PDEV_PARAM_BEACON_TX_MODE,
+        .resmgr_offchan_mode = WMI_10X_PDEV_PARAM_RESMGR_OFFCHAN_MODE,
+        .protection_mode = WMI_10X_PDEV_PARAM_PROTECTION_MODE,
+        .dynamic_bw = WMI_10X_PDEV_PARAM_DYNAMIC_BW,
+        .non_agg_sw_retry_th = WMI_10X_PDEV_PARAM_NON_AGG_SW_RETRY_TH,
+        .agg_sw_retry_th = WMI_10X_PDEV_PARAM_AGG_SW_RETRY_TH,
+        .sta_kickout_th = WMI_10X_PDEV_PARAM_STA_KICKOUT_TH,
+        .ac_aggrsize_scaling = WMI_10X_PDEV_PARAM_AC_AGGRSIZE_SCALING,
+        .ltr_enable = WMI_10X_PDEV_PARAM_LTR_ENABLE,
+        .ltr_ac_latency_be = WMI_10X_PDEV_PARAM_LTR_AC_LATENCY_BE,
+        .ltr_ac_latency_bk = WMI_10X_PDEV_PARAM_LTR_AC_LATENCY_BK,
+        .ltr_ac_latency_vi = WMI_10X_PDEV_PARAM_LTR_AC_LATENCY_VI,
+        .ltr_ac_latency_vo = WMI_10X_PDEV_PARAM_LTR_AC_LATENCY_VO,
+        .ltr_ac_latency_timeout = WMI_10X_PDEV_PARAM_LTR_AC_LATENCY_TIMEOUT,
+        .ltr_sleep_override = WMI_10X_PDEV_PARAM_LTR_SLEEP_OVERRIDE,
+        .ltr_rx_override = WMI_10X_PDEV_PARAM_LTR_RX_OVERRIDE,
+        .ltr_tx_activity_timeout = WMI_10X_PDEV_PARAM_LTR_TX_ACTIVITY_TIMEOUT,
+        .l1ss_enable = WMI_10X_PDEV_PARAM_L1SS_ENABLE,
+        .dsleep_enable = WMI_10X_PDEV_PARAM_DSLEEP_ENABLE,
+        .pcielp_txbuf_flush = WMI_PDEV_PARAM_UNSUPPORTED,
+        .pcielp_txbuf_watermark = WMI_PDEV_PARAM_UNSUPPORTED,
+        .pcielp_txbuf_tmo_en = WMI_PDEV_PARAM_UNSUPPORTED,
+        .pcielp_txbuf_tmo_value = WMI_PDEV_PARAM_UNSUPPORTED,
+        .pdev_stats_update_period = WMI_10X_PDEV_PARAM_PDEV_STATS_UPDATE_PERIOD,
+        .vdev_stats_update_period = WMI_10X_PDEV_PARAM_VDEV_STATS_UPDATE_PERIOD,
+        .peer_stats_update_period = WMI_10X_PDEV_PARAM_PEER_STATS_UPDATE_PERIOD,
+        .bcnflt_stats_update_period =
+                                WMI_10X_PDEV_PARAM_BCNFLT_STATS_UPDATE_PERIOD,
+        .pmf_qos = WMI_10X_PDEV_PARAM_PMF_QOS,
+        .arp_ac_override = WMI_10X_PDEV_PARAM_ARPDHCP_AC_OVERRIDE,
+        .dcs = WMI_10X_PDEV_PARAM_DCS,
+        .ani_enable = WMI_10X_PDEV_PARAM_ANI_ENABLE,
+        .ani_poll_period = WMI_10X_PDEV_PARAM_ANI_POLL_PERIOD,
+        .ani_listen_period = WMI_10X_PDEV_PARAM_ANI_LISTEN_PERIOD,
+        .ani_ofdm_level = WMI_10X_PDEV_PARAM_ANI_OFDM_LEVEL,
+        .ani_cck_level = WMI_10X_PDEV_PARAM_ANI_CCK_LEVEL,
+        .dyntxchain = WMI_10X_PDEV_PARAM_DYNTXCHAIN,
+        .proxy_sta = WMI_PDEV_PARAM_UNSUPPORTED,
+        .idle_ps_config = WMI_PDEV_PARAM_UNSUPPORTED,
+        .power_gating_sleep = WMI_PDEV_PARAM_UNSUPPORTED,
+        .fast_channel_reset = WMI_10X_PDEV_PARAM_FAST_CHANNEL_RESET,
+        .burst_dur = WMI_10X_PDEV_PARAM_BURST_DUR,
+        .burst_enable = WMI_10X_PDEV_PARAM_BURST_ENABLE,
+        .cal_period = WMI_10X_PDEV_PARAM_CAL_PERIOD,
 };
 
 /* firmware 10.2 specific mappings */
@@ -607,11 +846,11 @@ static struct wmi_cmd_map wmi_10_2_cmd_map = {
         .force_fw_hang_cmdid = WMI_CMD_UNSUPPORTED,
         .gpio_config_cmdid = WMI_10_2_GPIO_CONFIG_CMDID,
         .gpio_output_cmdid = WMI_10_2_GPIO_OUTPUT_CMDID,
+        .pdev_get_temperature_cmdid = WMI_CMD_UNSUPPORTED,
 };
 
-static void
-ath10k_wmi_put_wmi_channel(struct wmi_channel *ch,
-                           const struct wmi_channel_arg *arg)
+void ath10k_wmi_put_wmi_channel(struct wmi_channel *ch,
+                                const struct wmi_channel_arg *arg)
 {
         u32 flags = 0;
 
@@ -685,8 +924,8 @@ static void ath10k_wmi_htc_tx_complete(struct ath10k *ar, struct sk_buff *skb)
         dev_kfree_skb(skb);
 }
 
-static int ath10k_wmi_cmd_send_nowait(struct ath10k *ar, struct sk_buff *skb,
-                                      u32 cmd_id)
+int ath10k_wmi_cmd_send_nowait(struct ath10k *ar, struct sk_buff *skb,
+                               u32 cmd_id)
 {
         struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(skb);
         struct wmi_cmd_hdr *cmd_hdr;
@@ -717,23 +956,45 @@ err_pull:
 
 static void ath10k_wmi_tx_beacon_nowait(struct ath10k_vif *arvif)
 {
+        struct ath10k *ar = arvif->ar;
+        struct ath10k_skb_cb *cb;
+        struct sk_buff *bcn;
         int ret;
 
-        lockdep_assert_held(&arvif->ar->data_lock);
+        spin_lock_bh(&ar->data_lock);
 
-        if (arvif->beacon == NULL)
-                return;
+        bcn = arvif->beacon;
 
-        if (arvif->beacon_sent)
-                return;
+        if (!bcn)
+                goto unlock;
 
-        ret = ath10k_wmi_beacon_send_ref_nowait(arvif);
-        if (ret)
-                return;
+        cb = ATH10K_SKB_CB(bcn);
+
+        switch (arvif->beacon_state) {
+        case ATH10K_BEACON_SENDING:
+        case ATH10K_BEACON_SENT:
+                break;
+        case ATH10K_BEACON_SCHEDULED:
+                arvif->beacon_state = ATH10K_BEACON_SENDING;
+                spin_unlock_bh(&ar->data_lock);
+
+                ret = ath10k_wmi_beacon_send_ref_nowait(arvif->ar,
+                                                        arvif->vdev_id,
+                                                        bcn->data, bcn->len,
+                                                        cb->paddr,
+                                                        cb->bcn.dtim_zero,
+                                                        cb->bcn.deliver_cab);
+
+                spin_lock_bh(&ar->data_lock);
+
+                if (ret == 0)
+                        arvif->beacon_state = ATH10K_BEACON_SENT;
+                else
+                        arvif->beacon_state = ATH10K_BEACON_SCHEDULED;
+        }
 
-        /* We need to retain the arvif->beacon reference for DMA unmapping and
-         * freeing the skbuff later. */
-        arvif->beacon_sent = true;
+unlock:
+        spin_unlock_bh(&ar->data_lock);
 }
 
 static void ath10k_wmi_tx_beacons_iter(void *data, u8 *mac,
@@ -746,12 +1007,10 @@ static void ath10k_wmi_tx_beacons_iter(void *data, u8 *mac,
 
 static void ath10k_wmi_tx_beacons_nowait(struct ath10k *ar)
 {
-        spin_lock_bh(&ar->data_lock);
         ieee80211_iterate_active_interfaces_atomic(ar->hw,
                                                    IEEE80211_IFACE_ITER_NORMAL,
                                                    ath10k_wmi_tx_beacons_iter,
                                                    NULL);
-        spin_unlock_bh(&ar->data_lock);
 }
 
 static void ath10k_wmi_op_ep_tx_credits(struct ath10k *ar)
@@ -792,24 +1051,23 @@ int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id)
         return ret;
 }
 
-int ath10k_wmi_mgmt_tx(struct ath10k *ar, struct sk_buff *skb)
+static struct sk_buff *
+ath10k_wmi_op_gen_mgmt_tx(struct ath10k *ar, struct sk_buff *msdu)
 {
-        int ret = 0;
         struct wmi_mgmt_tx_cmd *cmd;
         struct ieee80211_hdr *hdr;
-        struct sk_buff *wmi_skb;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct sk_buff *skb;
         int len;
-        u32 buf_len = skb->len;
+        u32 buf_len = msdu->len;
         u16 fc;
 
-        hdr = (struct ieee80211_hdr *)skb->data;
+        hdr = (struct ieee80211_hdr *)msdu->data;
         fc = le16_to_cpu(hdr->frame_control);
 
         if (WARN_ON_ONCE(!ieee80211_is_mgmt(hdr->frame_control)))
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
 
-        len = sizeof(cmd->hdr) + skb->len;
+        len = sizeof(cmd->hdr) + msdu->len;
 
         if ((ieee80211_is_action(hdr->frame_control) ||
              ieee80211_is_deauth(hdr->frame_control) ||
@@ -821,36 +1079,27 @@ int ath10k_wmi_mgmt_tx(struct ath10k *ar, struct sk_buff *skb)
 
         len = round_up(len, 4);
 
-        wmi_skb = ath10k_wmi_alloc_skb(ar, len);
-        if (!wmi_skb)
-                return -ENOMEM;
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
 
-        cmd = (struct wmi_mgmt_tx_cmd *)wmi_skb->data;
+        cmd = (struct wmi_mgmt_tx_cmd *)skb->data;
 
-        cmd->hdr.vdev_id = __cpu_to_le32(ATH10K_SKB_CB(skb)->vdev_id);
+        cmd->hdr.vdev_id = __cpu_to_le32(ATH10K_SKB_CB(msdu)->vdev_id);
         cmd->hdr.tx_rate = 0;
         cmd->hdr.tx_power = 0;
         cmd->hdr.buf_len = __cpu_to_le32(buf_len);
 
         ether_addr_copy(cmd->hdr.peer_macaddr.addr, ieee80211_get_DA(hdr));
-        memcpy(cmd->buf, skb->data, skb->len);
+        memcpy(cmd->buf, msdu->data, msdu->len);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi mgmt tx skb %p len %d ftype %02x stype %02x\n",
-                   wmi_skb, wmi_skb->len, fc & IEEE80211_FCTL_FTYPE,
+                   msdu, skb->len, fc & IEEE80211_FCTL_FTYPE,
                    fc & IEEE80211_FCTL_STYPE);
         trace_ath10k_tx_hdr(ar, skb->data, skb->len);
         trace_ath10k_tx_payload(ar, skb->data, skb->len);
 
-        /* Send the management frame buffer to the target */
-        ret = ath10k_wmi_cmd_send(ar, wmi_skb, ar->wmi.cmd->mgmt_tx_cmdid);
-        if (ret)
-                return ret;
-
-        /* TODO: report tx status to mac80211 - temporary just ACK */
-        info->flags |= IEEE80211_TX_STAT_ACK;
-        ieee80211_tx_status_irqsafe(ar->hw, skb);
-
-        return ret;
+        return skb;
 }
 
 static void ath10k_wmi_event_scan_started(struct ath10k *ar)
@@ -977,22 +1226,48 @@ ath10k_wmi_event_scan_type_str(enum wmi_scan_event_type type,
         }
 }
 
-static int ath10k_wmi_event_scan(struct ath10k *ar, struct sk_buff *skb)
+static int ath10k_wmi_op_pull_scan_ev(struct ath10k *ar, struct sk_buff *skb,
+                                      struct wmi_scan_ev_arg *arg)
 {
-        struct wmi_scan_event *event = (struct wmi_scan_event *)skb->data;
+        struct wmi_scan_event *ev = (void *)skb->data;
+
+        if (skb->len < sizeof(*ev))
+                return -EPROTO;
+
+        skb_pull(skb, sizeof(*ev));
+        arg->event_type = ev->event_type;
+        arg->reason = ev->reason;
+        arg->channel_freq = ev->channel_freq;
+        arg->scan_req_id = ev->scan_req_id;
+        arg->scan_id = ev->scan_id;
+        arg->vdev_id = ev->vdev_id;
+
+        return 0;
+}
+
+int ath10k_wmi_event_scan(struct ath10k *ar, struct sk_buff *skb)
+{
+        struct wmi_scan_ev_arg arg = {};
         enum wmi_scan_event_type event_type;
         enum wmi_scan_completion_reason reason;
         u32 freq;
         u32 req_id;
         u32 scan_id;
         u32 vdev_id;
+        int ret;
+
+        ret = ath10k_wmi_pull_scan(ar, skb, &arg);
+        if (ret) {
+                ath10k_warn(ar, "failed to parse scan event: %d\n", ret);
+                return ret;
+        }
 
-        event_type = __le32_to_cpu(event->event_type);
-        reason     = __le32_to_cpu(event->reason);
-        freq       = __le32_to_cpu(event->channel_freq);
-        req_id     = __le32_to_cpu(event->scan_req_id);
-        scan_id    = __le32_to_cpu(event->scan_id);
-        vdev_id    = __le32_to_cpu(event->vdev_id);
+        event_type = __le32_to_cpu(arg.event_type);
+        reason = __le32_to_cpu(arg.reason);
+        freq = __le32_to_cpu(arg.channel_freq);
+        req_id = __le32_to_cpu(arg.scan_req_id);
+        scan_id = __le32_to_cpu(arg.scan_id);
+        vdev_id = __le32_to_cpu(arg.vdev_id);
 
         spin_lock_bh(&ar->data_lock);
 
@@ -1147,11 +1422,51 @@ static void ath10k_wmi_handle_wep_reauth(struct ath10k *ar,
         }
 }
 
-static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
+static int ath10k_wmi_op_pull_mgmt_rx_ev(struct ath10k *ar, struct sk_buff *skb,
+                                         struct wmi_mgmt_rx_ev_arg *arg)
 {
         struct wmi_mgmt_rx_event_v1 *ev_v1;
         struct wmi_mgmt_rx_event_v2 *ev_v2;
         struct wmi_mgmt_rx_hdr_v1 *ev_hdr;
+        size_t pull_len;
+        u32 msdu_len;
+
+        if (test_bit(ATH10K_FW_FEATURE_EXT_WMI_MGMT_RX, ar->fw_features)) {
+                ev_v2 = (struct wmi_mgmt_rx_event_v2 *)skb->data;
+                ev_hdr = &ev_v2->hdr.v1;
+                pull_len = sizeof(*ev_v2);
+        } else {
+                ev_v1 = (struct wmi_mgmt_rx_event_v1 *)skb->data;
+                ev_hdr = &ev_v1->hdr;
+                pull_len = sizeof(*ev_v1);
+        }
+
+        if (skb->len < pull_len)
+                return -EPROTO;
+
+        skb_pull(skb, pull_len);
+        arg->channel = ev_hdr->channel;
+        arg->buf_len = ev_hdr->buf_len;
+        arg->status = ev_hdr->status;
+        arg->snr = ev_hdr->snr;
+        arg->phy_mode = ev_hdr->phy_mode;
+        arg->rate = ev_hdr->rate;
+
+        msdu_len = __le32_to_cpu(arg->buf_len);
+        if (skb->len < msdu_len)
+                return -EPROTO;
+
+        /* the WMI buffer might've ended up being padded to 4 bytes due to HTC
+         * trailer with credit update. Trim the excess garbage.
+         */
+        skb_trim(skb, msdu_len);
+
+        return 0;
+}
+
+int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
+{
+        struct wmi_mgmt_rx_ev_arg arg = {};
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_hdr *hdr;
         u32 rx_status;
@@ -1161,24 +1476,20 @@ static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
         u32 rate;
         u32 buf_len;
         u16 fc;
-        int pull_len;
+        int ret;
 
-        if (test_bit(ATH10K_FW_FEATURE_EXT_WMI_MGMT_RX, ar->fw_features)) {
-                ev_v2 = (struct wmi_mgmt_rx_event_v2 *)skb->data;
-                ev_hdr = &ev_v2->hdr.v1;
-                pull_len = sizeof(*ev_v2);
-        } else {
-                ev_v1 = (struct wmi_mgmt_rx_event_v1 *)skb->data;
-                ev_hdr = &ev_v1->hdr;
-                pull_len = sizeof(*ev_v1);
+        ret = ath10k_wmi_pull_mgmt_rx(ar, skb, &arg);
+        if (ret) {
+                ath10k_warn(ar, "failed to parse mgmt rx event: %d\n", ret);
+                return ret;
         }
 
-        channel   = __le32_to_cpu(ev_hdr->channel);
-        buf_len   = __le32_to_cpu(ev_hdr->buf_len);
-        rx_status = __le32_to_cpu(ev_hdr->status);
-        snr       = __le32_to_cpu(ev_hdr->snr);
-        phy_mode  = __le32_to_cpu(ev_hdr->phy_mode);
-        rate      = __le32_to_cpu(ev_hdr->rate);
+        channel = __le32_to_cpu(arg.channel);
+        buf_len = __le32_to_cpu(arg.buf_len);
+        rx_status = __le32_to_cpu(arg.status);
+        snr = __le32_to_cpu(arg.snr);
+        phy_mode = __le32_to_cpu(arg.phy_mode);
+        rate = __le32_to_cpu(arg.rate);
 
         memset(status, 0, sizeof(*status));
 
@@ -1232,8 +1543,6 @@ static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
         status->signal = snr + ATH10K_DEFAULT_NOISE_FLOOR;
         status->rate_idx = get_rate_idx(rate, status->band);
 
-        skb_pull(skb, pull_len);
-
         hdr = (struct ieee80211_hdr *)skb->data;
         fc = le16_to_cpu(hdr->frame_control);
 
@@ -1266,12 +1575,6 @@ static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
                    status->freq, status->band, status->signal,
                    status->rate_idx);
 
-        /*
-         * packets from HTC come aligned to 4byte boundaries
-         * because they can originally come in along with a trailer
-         */
-        skb_trim(skb, buf_len);
-
         ieee80211_rx(ar->hw, skb);
         return 0;
 }
@@ -1295,21 +1598,44 @@ exit:
         return idx;
 }
 
-static void ath10k_wmi_event_chan_info(struct ath10k *ar, struct sk_buff *skb)
+static int ath10k_wmi_op_pull_ch_info_ev(struct ath10k *ar, struct sk_buff *skb,
+                                         struct wmi_ch_info_ev_arg *arg)
 {
-        struct wmi_chan_info_event *ev;
+        struct wmi_chan_info_event *ev = (void *)skb->data;
+
+        if (skb->len < sizeof(*ev))
+                return -EPROTO;
+
+        skb_pull(skb, sizeof(*ev));
+        arg->err_code = ev->err_code;
+        arg->freq = ev->freq;
+        arg->cmd_flags = ev->cmd_flags;
+        arg->noise_floor = ev->noise_floor;
+        arg->rx_clear_count = ev->rx_clear_count;
+        arg->cycle_count = ev->cycle_count;
+
+        return 0;
+}
+
+void ath10k_wmi_event_chan_info(struct ath10k *ar, struct sk_buff *skb)
+{
+        struct wmi_ch_info_ev_arg arg = {};
         struct survey_info *survey;
         u32 err_code, freq, cmd_flags, noise_floor, rx_clear_count, cycle_count;
-        int idx;
+        int idx, ret;
 
-        ev = (struct wmi_chan_info_event *)skb->data;
+        ret = ath10k_wmi_pull_ch_info(ar, skb, &arg);
+        if (ret) {
+                ath10k_warn(ar, "failed to parse chan info event: %d\n", ret);
+                return;
+        }
 
-        err_code = __le32_to_cpu(ev->err_code);
-        freq = __le32_to_cpu(ev->freq);
-        cmd_flags = __le32_to_cpu(ev->cmd_flags);
-        noise_floor = __le32_to_cpu(ev->noise_floor);
-        rx_clear_count = __le32_to_cpu(ev->rx_clear_count);
-        cycle_count = __le32_to_cpu(ev->cycle_count);
+        err_code = __le32_to_cpu(arg.err_code);
+        freq = __le32_to_cpu(arg.freq);
+        cmd_flags = __le32_to_cpu(arg.cmd_flags);
+        noise_floor = __le32_to_cpu(arg.noise_floor);
+        rx_clear_count = __le32_to_cpu(arg.rx_clear_count);
+        cycle_count = __le32_to_cpu(arg.cycle_count);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "chan info err_code %d freq %d cmd_flags %d noise_floor %d rx_clear_count %d cycle_count %d\n",
@@ -1344,11 +1670,11 @@ static void ath10k_wmi_event_chan_info(struct ath10k *ar, struct sk_buff *skb)
                 rx_clear_count -= ar->survey_last_rx_clear_count;
 
                 survey = &ar->survey[idx];
-                survey->channel_time = WMI_CHAN_INFO_MSEC(cycle_count);
-                survey->channel_time_rx = WMI_CHAN_INFO_MSEC(rx_clear_count);
+                survey->time = WMI_CHAN_INFO_MSEC(cycle_count);
+                survey->time_rx = WMI_CHAN_INFO_MSEC(rx_clear_count);
                 survey->noise = noise_floor;
-                survey->filled = SURVEY_INFO_CHANNEL_TIME |
-                                 SURVEY_INFO_CHANNEL_TIME_RX |
+                survey->filled = SURVEY_INFO_TIME |
+                                 SURVEY_INFO_TIME_RX |
                                  SURVEY_INFO_NOISE_DBM;
         }
 
@@ -1359,12 +1685,12 @@ exit:
         spin_unlock_bh(&ar->data_lock);
 }
 
-static void ath10k_wmi_event_echo(struct ath10k *ar, struct sk_buff *skb)
+void ath10k_wmi_event_echo(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_ECHO_EVENTID\n");
 }
 
-static int ath10k_wmi_event_debug_mesg(struct ath10k *ar, struct sk_buff *skb)
+int ath10k_wmi_event_debug_mesg(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi event debug mesg len %d\n",
                    skb->len);
@@ -1374,12 +1700,9 @@ static int ath10k_wmi_event_debug_mesg(struct ath10k *ar, struct sk_buff *skb)
         return 0;
 }
 
-static void ath10k_wmi_pull_pdev_stats(const struct wmi_pdev_stats *src,
-                                       struct ath10k_fw_stats_pdev *dst)
+void ath10k_wmi_pull_pdev_stats_base(const struct wmi_pdev_stats_base *src,
+                                     struct ath10k_fw_stats_pdev *dst)
 {
-        const struct wal_dbg_tx_stats *tx = &src->wal.tx;
-        const struct wal_dbg_rx_stats *rx = &src->wal.rx;
-
         dst->ch_noise_floor = __le32_to_cpu(src->chan_nf);
         dst->tx_frame_count = __le32_to_cpu(src->tx_frame_count);
         dst->rx_frame_count = __le32_to_cpu(src->rx_frame_count);
@@ -1387,57 +1710,76 @@ static void ath10k_wmi_pull_pdev_stats(const struct wmi_pdev_stats *src,
         dst->cycle_count = __le32_to_cpu(src->cycle_count);
         dst->phy_err_count = __le32_to_cpu(src->phy_err_count);
         dst->chan_tx_power = __le32_to_cpu(src->chan_tx_pwr);
+}
 
-        dst->comp_queued = __le32_to_cpu(tx->comp_queued);
-        dst->comp_delivered = __le32_to_cpu(tx->comp_delivered);
-        dst->msdu_enqued = __le32_to_cpu(tx->msdu_enqued);
-        dst->mpdu_enqued = __le32_to_cpu(tx->mpdu_enqued);
-        dst->wmm_drop = __le32_to_cpu(tx->wmm_drop);
-        dst->local_enqued = __le32_to_cpu(tx->local_enqued);
-        dst->local_freed = __le32_to_cpu(tx->local_freed);
-        dst->hw_queued = __le32_to_cpu(tx->hw_queued);
-        dst->hw_reaped = __le32_to_cpu(tx->hw_reaped);
-        dst->underrun = __le32_to_cpu(tx->underrun);
-        dst->tx_abort = __le32_to_cpu(tx->tx_abort);
-        dst->mpdus_requed = __le32_to_cpu(tx->mpdus_requed);
-        dst->tx_ko = __le32_to_cpu(tx->tx_ko);
-        dst->data_rc = __le32_to_cpu(tx->data_rc);
-        dst->self_triggers = __le32_to_cpu(tx->self_triggers);
-        dst->sw_retry_failure = __le32_to_cpu(tx->sw_retry_failure);
-        dst->illgl_rate_phy_err = __le32_to_cpu(tx->illgl_rate_phy_err);
-        dst->pdev_cont_xretry = __le32_to_cpu(tx->pdev_cont_xretry);
-        dst->pdev_tx_timeout = __le32_to_cpu(tx->pdev_tx_timeout);
-        dst->pdev_resets = __le32_to_cpu(tx->pdev_resets);
-        dst->phy_underrun = __le32_to_cpu(tx->phy_underrun);
-        dst->txop_ovf = __le32_to_cpu(tx->txop_ovf);
-
-        dst->mid_ppdu_route_change = __le32_to_cpu(rx->mid_ppdu_route_change);
-        dst->status_rcvd = __le32_to_cpu(rx->status_rcvd);
-        dst->r0_frags = __le32_to_cpu(rx->r0_frags);
-        dst->r1_frags = __le32_to_cpu(rx->r1_frags);
-        dst->r2_frags = __le32_to_cpu(rx->r2_frags);
-        dst->r3_frags = __le32_to_cpu(rx->r3_frags);
-        dst->htt_msdus = __le32_to_cpu(rx->htt_msdus);
-        dst->htt_mpdus = __le32_to_cpu(rx->htt_mpdus);
-        dst->loc_msdus = __le32_to_cpu(rx->loc_msdus);
-        dst->loc_mpdus = __le32_to_cpu(rx->loc_mpdus);
-        dst->oversize_amsdu = __le32_to_cpu(rx->oversize_amsdu);
-        dst->phy_errs = __le32_to_cpu(rx->phy_errs);
-        dst->phy_err_drop = __le32_to_cpu(rx->phy_err_drop);
-        dst->mpdu_errs = __le32_to_cpu(rx->mpdu_errs);
-}
-
-static void ath10k_wmi_pull_peer_stats(const struct wmi_peer_stats *src,
-                                       struct ath10k_fw_stats_peer *dst)
+void ath10k_wmi_pull_pdev_stats_tx(const struct wmi_pdev_stats_tx *src,
+                                   struct ath10k_fw_stats_pdev *dst)
+{
+        dst->comp_queued = __le32_to_cpu(src->comp_queued);
+        dst->comp_delivered = __le32_to_cpu(src->comp_delivered);
+        dst->msdu_enqued = __le32_to_cpu(src->msdu_enqued);
+        dst->mpdu_enqued = __le32_to_cpu(src->mpdu_enqued);
+        dst->wmm_drop = __le32_to_cpu(src->wmm_drop);
+        dst->local_enqued = __le32_to_cpu(src->local_enqued);
+        dst->local_freed = __le32_to_cpu(src->local_freed);
+        dst->hw_queued = __le32_to_cpu(src->hw_queued);
+        dst->hw_reaped = __le32_to_cpu(src->hw_reaped);
+        dst->underrun = __le32_to_cpu(src->underrun);
+        dst->tx_abort = __le32_to_cpu(src->tx_abort);
+        dst->mpdus_requed = __le32_to_cpu(src->mpdus_requed);
+        dst->tx_ko = __le32_to_cpu(src->tx_ko);
+        dst->data_rc = __le32_to_cpu(src->data_rc);
+        dst->self_triggers = __le32_to_cpu(src->self_triggers);
+        dst->sw_retry_failure = __le32_to_cpu(src->sw_retry_failure);
+        dst->illgl_rate_phy_err = __le32_to_cpu(src->illgl_rate_phy_err);
+        dst->pdev_cont_xretry = __le32_to_cpu(src->pdev_cont_xretry);
+        dst->pdev_tx_timeout = __le32_to_cpu(src->pdev_tx_timeout);
+        dst->pdev_resets = __le32_to_cpu(src->pdev_resets);
+        dst->phy_underrun = __le32_to_cpu(src->phy_underrun);
+        dst->txop_ovf = __le32_to_cpu(src->txop_ovf);
+}
+
+void ath10k_wmi_pull_pdev_stats_rx(const struct wmi_pdev_stats_rx *src,
+                                   struct ath10k_fw_stats_pdev *dst)
+{
+        dst->mid_ppdu_route_change = __le32_to_cpu(src->mid_ppdu_route_change);
+        dst->status_rcvd = __le32_to_cpu(src->status_rcvd);
+        dst->r0_frags = __le32_to_cpu(src->r0_frags);
+        dst->r1_frags = __le32_to_cpu(src->r1_frags);
+        dst->r2_frags = __le32_to_cpu(src->r2_frags);
+        dst->r3_frags = __le32_to_cpu(src->r3_frags);
+        dst->htt_msdus = __le32_to_cpu(src->htt_msdus);
+        dst->htt_mpdus = __le32_to_cpu(src->htt_mpdus);
+        dst->loc_msdus = __le32_to_cpu(src->loc_msdus);
+        dst->loc_mpdus = __le32_to_cpu(src->loc_mpdus);
+        dst->oversize_amsdu = __le32_to_cpu(src->oversize_amsdu);
+        dst->phy_errs = __le32_to_cpu(src->phy_errs);
+        dst->phy_err_drop = __le32_to_cpu(src->phy_err_drop);
+        dst->mpdu_errs = __le32_to_cpu(src->mpdu_errs);
+}
+
+void ath10k_wmi_pull_pdev_stats_extra(const struct wmi_pdev_stats_extra *src,
+                                      struct ath10k_fw_stats_pdev *dst)
+{
+        dst->ack_rx_bad = __le32_to_cpu(src->ack_rx_bad);
+        dst->rts_bad = __le32_to_cpu(src->rts_bad);
+        dst->rts_good = __le32_to_cpu(src->rts_good);
+        dst->fcs_bad = __le32_to_cpu(src->fcs_bad);
+        dst->no_beacons = __le32_to_cpu(src->no_beacons);
+        dst->mib_int_count = __le32_to_cpu(src->mib_int_count);
+}
+
+void ath10k_wmi_pull_peer_stats(const struct wmi_peer_stats *src,
+                                struct ath10k_fw_stats_peer *dst)
 {
         ether_addr_copy(dst->peer_macaddr, src->peer_macaddr.addr);
         dst->peer_rssi = __le32_to_cpu(src->peer_rssi);
         dst->peer_tx_rate = __le32_to_cpu(src->peer_tx_rate);
 }
 
-static int ath10k_wmi_main_pull_fw_stats(struct ath10k *ar,
-                                         struct sk_buff *skb,
-                                         struct ath10k_fw_stats *stats)
+static int ath10k_wmi_main_op_pull_fw_stats(struct ath10k *ar,
+                                            struct sk_buff *skb,
+                                            struct ath10k_fw_stats *stats)
 {
         const struct wmi_stats_event *ev = (void *)skb->data;
         u32 num_pdev_stats, num_vdev_stats, num_peer_stats;
@@ -1462,7 +1804,10 @@ static int ath10k_wmi_main_pull_fw_stats(struct ath10k *ar,
                 if (!dst)
                         continue;
 
-                ath10k_wmi_pull_pdev_stats(src, dst);
+                ath10k_wmi_pull_pdev_stats_base(&src->base, dst);
+                ath10k_wmi_pull_pdev_stats_tx(&src->tx, dst);
+                ath10k_wmi_pull_pdev_stats_rx(&src->rx, dst);
+
                 list_add_tail(&dst->list, &stats->pdevs);
         }
 
@@ -1487,9 +1832,9 @@ static int ath10k_wmi_main_pull_fw_stats(struct ath10k *ar,
         return 0;
 }
 
-static int ath10k_wmi_10x_pull_fw_stats(struct ath10k *ar,
-                                        struct sk_buff *skb,
-                                        struct ath10k_fw_stats *stats)
+static int ath10k_wmi_10x_op_pull_fw_stats(struct ath10k *ar,
+                                           struct sk_buff *skb,
+                                           struct ath10k_fw_stats *stats)
 {
         const struct wmi_stats_event *ev = (void *)skb->data;
         u32 num_pdev_stats, num_vdev_stats, num_peer_stats;
@@ -1514,14 +1859,10 @@ static int ath10k_wmi_10x_pull_fw_stats(struct ath10k *ar,
                 if (!dst)
                         continue;
 
-                ath10k_wmi_pull_pdev_stats(&src->old, dst);
-
-                dst->ack_rx_bad = __le32_to_cpu(src->ack_rx_bad);
-                dst->rts_bad = __le32_to_cpu(src->rts_bad);
-                dst->rts_good = __le32_to_cpu(src->rts_good);
-                dst->fcs_bad = __le32_to_cpu(src->fcs_bad);
-                dst->no_beacons = __le32_to_cpu(src->no_beacons);
-                dst->mib_int_count = __le32_to_cpu(src->mib_int_count);
+                ath10k_wmi_pull_pdev_stats_base(&src->base, dst);
+                ath10k_wmi_pull_pdev_stats_tx(&src->tx, dst);
+                ath10k_wmi_pull_pdev_stats_rx(&src->rx, dst);
+                ath10k_wmi_pull_pdev_stats_extra(&src->extra, dst);
 
                 list_add_tail(&dst->list, &stats->pdevs);
         }
@@ -1550,61 +1891,250 @@ static int ath10k_wmi_10x_pull_fw_stats(struct ath10k *ar,
         return 0;
 }
 
-int ath10k_wmi_pull_fw_stats(struct ath10k *ar, struct sk_buff *skb,
-                             struct ath10k_fw_stats *stats)
+static int ath10k_wmi_10_2_op_pull_fw_stats(struct ath10k *ar,
+                                            struct sk_buff *skb,
+                                            struct ath10k_fw_stats *stats)
 {
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features))
-                return ath10k_wmi_10x_pull_fw_stats(ar, skb, stats);
-        else
-                return ath10k_wmi_main_pull_fw_stats(ar, skb, stats);
+        const struct wmi_10_2_stats_event *ev = (void *)skb->data;
+        u32 num_pdev_stats;
+        u32 num_pdev_ext_stats;
+        u32 num_vdev_stats;
+        u32 num_peer_stats;
+        int i;
+
+        if (!skb_pull(skb, sizeof(*ev)))
+                return -EPROTO;
+
+        num_pdev_stats = __le32_to_cpu(ev->num_pdev_stats);
+        num_pdev_ext_stats = __le32_to_cpu(ev->num_pdev_ext_stats);
+        num_vdev_stats = __le32_to_cpu(ev->num_vdev_stats);
+        num_peer_stats = __le32_to_cpu(ev->num_peer_stats);
+
+        for (i = 0; i < num_pdev_stats; i++) {
+                const struct wmi_10_2_pdev_stats *src;
+                struct ath10k_fw_stats_pdev *dst;
+
+                src = (void *)skb->data;
+                if (!skb_pull(skb, sizeof(*src)))
+                        return -EPROTO;
+
+                dst = kzalloc(sizeof(*dst), GFP_ATOMIC);
+                if (!dst)
+                        continue;
+
+                ath10k_wmi_pull_pdev_stats_base(&src->base, dst);
+                ath10k_wmi_pull_pdev_stats_tx(&src->tx, dst);
+                ath10k_wmi_pull_pdev_stats_rx(&src->rx, dst);
+                ath10k_wmi_pull_pdev_stats_extra(&src->extra, dst);
+                /* FIXME: expose 10.2 specific values */
+
+                list_add_tail(&dst->list, &stats->pdevs);
+        }
+
+        for (i = 0; i < num_pdev_ext_stats; i++) {
+                const struct wmi_10_2_pdev_ext_stats *src;
+
+                src = (void *)skb->data;
+                if (!skb_pull(skb, sizeof(*src)))
+                        return -EPROTO;
+
+                /* FIXME: expose values to userspace
+                 *
+                 * Note: Even though this loop seems to do nothing it is
+                 * required to parse following sub-structures properly.
+                 */
+        }
+
+        /* fw doesn't implement vdev stats */
+
+        for (i = 0; i < num_peer_stats; i++) {
+                const struct wmi_10_2_peer_stats *src;
+                struct ath10k_fw_stats_peer *dst;
+
+                src = (void *)skb->data;
+                if (!skb_pull(skb, sizeof(*src)))
+                        return -EPROTO;
+
+                dst = kzalloc(sizeof(*dst), GFP_ATOMIC);
+                if (!dst)
+                        continue;
+
+                ath10k_wmi_pull_peer_stats(&src->old, dst);
+
+                dst->peer_rx_rate = __le32_to_cpu(src->peer_rx_rate);
+                /* FIXME: expose 10.2 specific values */
+
+                list_add_tail(&dst->list, &stats->peers);
+        }
+
+        return 0;
+}
+
+static int ath10k_wmi_10_2_4_op_pull_fw_stats(struct ath10k *ar,
+                                              struct sk_buff *skb,
+                                              struct ath10k_fw_stats *stats)
+{
+        const struct wmi_10_2_stats_event *ev = (void *)skb->data;
+        u32 num_pdev_stats;
+        u32 num_pdev_ext_stats;
+        u32 num_vdev_stats;
+        u32 num_peer_stats;
+        int i;
+
+        if (!skb_pull(skb, sizeof(*ev)))
+                return -EPROTO;
+
+        num_pdev_stats = __le32_to_cpu(ev->num_pdev_stats);
+        num_pdev_ext_stats = __le32_to_cpu(ev->num_pdev_ext_stats);
+        num_vdev_stats = __le32_to_cpu(ev->num_vdev_stats);
+        num_peer_stats = __le32_to_cpu(ev->num_peer_stats);
+
+        for (i = 0; i < num_pdev_stats; i++) {
+                const struct wmi_10_2_pdev_stats *src;
+                struct ath10k_fw_stats_pdev *dst;
+
+                src = (void *)skb->data;
+                if (!skb_pull(skb, sizeof(*src)))
+                        return -EPROTO;
+
+                dst = kzalloc(sizeof(*dst), GFP_ATOMIC);
+                if (!dst)
+                        continue;
+
+                ath10k_wmi_pull_pdev_stats_base(&src->base, dst);
+                ath10k_wmi_pull_pdev_stats_tx(&src->tx, dst);
+                ath10k_wmi_pull_pdev_stats_rx(&src->rx, dst);
+                ath10k_wmi_pull_pdev_stats_extra(&src->extra, dst);
+                /* FIXME: expose 10.2 specific values */
+
+                list_add_tail(&dst->list, &stats->pdevs);
+        }
+
+        for (i = 0; i < num_pdev_ext_stats; i++) {
+                const struct wmi_10_2_pdev_ext_stats *src;
+
+                src = (void *)skb->data;
+                if (!skb_pull(skb, sizeof(*src)))
+                        return -EPROTO;
+
+                /* FIXME: expose values to userspace
+                 *
+                 * Note: Even though this loop seems to do nothing it is
+                 * required to parse following sub-structures properly.
+                 */
+        }
+
+        /* fw doesn't implement vdev stats */
+
+        for (i = 0; i < num_peer_stats; i++) {
+                const struct wmi_10_2_4_peer_stats *src;
+                struct ath10k_fw_stats_peer *dst;
+
+                src = (void *)skb->data;
+                if (!skb_pull(skb, sizeof(*src)))
+                        return -EPROTO;
+
+                dst = kzalloc(sizeof(*dst), GFP_ATOMIC);
+                if (!dst)
+                        continue;
+
+                ath10k_wmi_pull_peer_stats(&src->common.old, dst);
+
+                dst->peer_rx_rate = __le32_to_cpu(src->common.peer_rx_rate);
+                /* FIXME: expose 10.2 specific values */
+
+                list_add_tail(&dst->list, &stats->peers);
+        }
+
+        return 0;
 }
 
-static void ath10k_wmi_event_update_stats(struct ath10k *ar,
-                                          struct sk_buff *skb)
+void ath10k_wmi_event_update_stats(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_UPDATE_STATS_EVENTID\n");
         ath10k_debug_fw_stats_process(ar, skb);
 }
 
-static void ath10k_wmi_event_vdev_start_resp(struct ath10k *ar,
-                                             struct sk_buff *skb)
+static int
+ath10k_wmi_op_pull_vdev_start_ev(struct ath10k *ar, struct sk_buff *skb,
+                                 struct wmi_vdev_start_ev_arg *arg)
+{
+        struct wmi_vdev_start_response_event *ev = (void *)skb->data;
+
+        if (skb->len < sizeof(*ev))
+                return -EPROTO;
+
+        skb_pull(skb, sizeof(*ev));
+        arg->vdev_id = ev->vdev_id;
+        arg->req_id = ev->req_id;
+        arg->resp_type = ev->resp_type;
+        arg->status = ev->status;
+
+        return 0;
+}
+
+void ath10k_wmi_event_vdev_start_resp(struct ath10k *ar, struct sk_buff *skb)
 {
-        struct wmi_vdev_start_response_event *ev;
+        struct wmi_vdev_start_ev_arg arg = {};
+        int ret;
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_VDEV_START_RESP_EVENTID\n");
 
-        ev = (struct wmi_vdev_start_response_event *)skb->data;
+        ret = ath10k_wmi_pull_vdev_start(ar, skb, &arg);
+        if (ret) {
+                ath10k_warn(ar, "failed to parse vdev start event: %d\n", ret);
+                return;
+        }
 
-        if (WARN_ON(__le32_to_cpu(ev->status)))
+        if (WARN_ON(__le32_to_cpu(arg.status)))
                 return;
 
         complete(&ar->vdev_setup_done);
 }
 
-static void ath10k_wmi_event_vdev_stopped(struct ath10k *ar,
-                                          struct sk_buff *skb)
+void ath10k_wmi_event_vdev_stopped(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_VDEV_STOPPED_EVENTID\n");
         complete(&ar->vdev_setup_done);
 }
 
-static void ath10k_wmi_event_peer_sta_kickout(struct ath10k *ar,
-                                              struct sk_buff *skb)
+static int
+ath10k_wmi_op_pull_peer_kick_ev(struct ath10k *ar, struct sk_buff *skb,
+                                struct wmi_peer_kick_ev_arg *arg)
 {
-        struct wmi_peer_sta_kickout_event *ev;
+        struct wmi_peer_sta_kickout_event *ev = (void *)skb->data;
+
+        if (skb->len < sizeof(*ev))
+                return -EPROTO;
+
+        skb_pull(skb, sizeof(*ev));
+        arg->mac_addr = ev->peer_macaddr.addr;
+
+        return 0;
+}
+
+void ath10k_wmi_event_peer_sta_kickout(struct ath10k *ar, struct sk_buff *skb)
+{
+        struct wmi_peer_kick_ev_arg arg = {};
         struct ieee80211_sta *sta;
+        int ret;
 
-        ev = (struct wmi_peer_sta_kickout_event *)skb->data;
+        ret = ath10k_wmi_pull_peer_kick(ar, skb, &arg);
+        if (ret) {
+                ath10k_warn(ar, "failed to parse peer kickout event: %d\n",
+                            ret);
+                return;
+        }
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi event peer sta kickout %pM\n",
-                   ev->peer_macaddr.addr);
+                   arg.mac_addr);
 
         rcu_read_lock();
 
-        sta = ieee80211_find_sta_by_ifaddr(ar->hw, ev->peer_macaddr.addr, NULL);
+        sta = ieee80211_find_sta_by_ifaddr(ar->hw, arg.mac_addr, NULL);
         if (!sta) {
                 ath10k_warn(ar, "Spurious quick kickout for STA %pM\n",
-                            ev->peer_macaddr.addr);
+                            arg.mac_addr);
                 goto exit;
         }
 
@@ -1641,7 +2171,7 @@ exit:
 static void ath10k_wmi_update_tim(struct ath10k *ar,
                                   struct ath10k_vif *arvif,
                                   struct sk_buff *bcn,
-                                  struct wmi_bcn_info *bcn_info)
+                                  const struct wmi_tim_info *tim_info)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)bcn->data;
         struct ieee80211_tim_ie *tim;
@@ -1652,14 +2182,14 @@ static void ath10k_wmi_update_tim(struct ath10k *ar,
 
         /* if next SWBA has no tim_changed the tim_bitmap is garbage.
          * we must copy the bitmap upon change and reuse it later */
-        if (__le32_to_cpu(bcn_info->tim_info.tim_changed)) {
+        if (__le32_to_cpu(tim_info->tim_changed)) {
                 int i;
 
                 BUILD_BUG_ON(sizeof(arvif->u.ap.tim_bitmap) !=
-                             sizeof(bcn_info->tim_info.tim_bitmap));
+                             sizeof(tim_info->tim_bitmap));
 
                 for (i = 0; i < sizeof(arvif->u.ap.tim_bitmap); i++) {
-                        t = bcn_info->tim_info.tim_bitmap[i / 4];
+                        t = tim_info->tim_bitmap[i / 4];
                         v = __le32_to_cpu(t);
                         arvif->u.ap.tim_bitmap[i] = (v >> ((i % 4) * 8)) & 0xFF;
                 }
@@ -1711,13 +2241,13 @@ static void ath10k_wmi_update_tim(struct ath10k *ar,
                 return;
         }
 
-        tim->bitmap_ctrl = !!__le32_to_cpu(bcn_info->tim_info.tim_mcast);
+        tim->bitmap_ctrl = !!__le32_to_cpu(tim_info->tim_mcast);
         memcpy(tim->virtual_map, arvif->u.ap.tim_bitmap, pvm_len);
 
         if (tim->dtim_count == 0) {
                 ATH10K_SKB_CB(bcn)->bcn.dtim_zero = true;
 
-                if (__le32_to_cpu(bcn_info->tim_info.tim_mcast) == 1)
+                if (__le32_to_cpu(tim_info->tim_mcast) == 1)
                         ATH10K_SKB_CB(bcn)->bcn.deliver_cab = true;
         }
 
@@ -1727,7 +2257,7 @@ static void ath10k_wmi_update_tim(struct ath10k *ar,
 }
 
 static void ath10k_p2p_fill_noa_ie(u8 *data, u32 len,
-                                   struct wmi_p2p_noa_info *noa)
+                                   const struct wmi_p2p_noa_info *noa)
 {
         struct ieee80211_p2p_noa_attr *noa_attr;
         u8  ctwindow_oppps = noa->ctwindow_oppps;
@@ -1769,7 +2299,7 @@ static void ath10k_p2p_fill_noa_ie(u8 *data, u32 len,
         *noa_attr_len = __cpu_to_le16(attr_len);
 }
 
-static u32 ath10k_p2p_calc_noa_ie_len(struct wmi_p2p_noa_info *noa)
+static u32 ath10k_p2p_calc_noa_ie_len(const struct wmi_p2p_noa_info *noa)
 {
         u32 len = 0;
         u8 noa_descriptors = noa->num_descriptors;
@@ -1789,9 +2319,8 @@ static u32 ath10k_p2p_calc_noa_ie_len(struct wmi_p2p_noa_info *noa)
 
 static void ath10k_wmi_update_noa(struct ath10k *ar, struct ath10k_vif *arvif,
                                   struct sk_buff *bcn,
-                                  struct wmi_bcn_info *bcn_info)
+                                  const struct wmi_p2p_noa_info *noa)
 {
-        struct wmi_p2p_noa_info *noa = &bcn_info->p2p_noa_info;
         u8 *new_data, *old_data = arvif->u.ap.noa_data;
         u32 new_len;
 
@@ -1832,22 +2361,59 @@ cleanup:
         kfree(old_data);
 }
 
-static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
+static int ath10k_wmi_op_pull_swba_ev(struct ath10k *ar, struct sk_buff *skb,
+                                      struct wmi_swba_ev_arg *arg)
 {
-        struct wmi_host_swba_event *ev;
+        struct wmi_host_swba_event *ev = (void *)skb->data;
+        u32 map;
+        size_t i;
+
+        if (skb->len < sizeof(*ev))
+                return -EPROTO;
+
+        skb_pull(skb, sizeof(*ev));
+        arg->vdev_map = ev->vdev_map;
+
+        for (i = 0, map = __le32_to_cpu(ev->vdev_map); map; map >>= 1) {
+                if (!(map & BIT(0)))
+                        continue;
+
+                /* If this happens there were some changes in firmware and
+                 * ath10k should update the max size of tim_info array.
+                 */
+                if (WARN_ON_ONCE(i == ARRAY_SIZE(arg->tim_info)))
+                        break;
+
+                arg->tim_info[i] = &ev->bcn_info[i].tim_info;
+                arg->noa_info[i] = &ev->bcn_info[i].p2p_noa_info;
+                i++;
+        }
+
+        return 0;
+}
+
+void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
+{
+        struct wmi_swba_ev_arg arg = {};
         u32 map;
         int i = -1;
-        struct wmi_bcn_info *bcn_info;
+        const struct wmi_tim_info *tim_info;
+        const struct wmi_p2p_noa_info *noa_info;
         struct ath10k_vif *arvif;
         struct sk_buff *bcn;
         dma_addr_t paddr;
         int ret, vdev_id = 0;
 
-        ev = (struct wmi_host_swba_event *)skb->data;
-        map = __le32_to_cpu(ev->vdev_map);
+        ret = ath10k_wmi_pull_swba(ar, skb, &arg);
+        if (ret) {
+                ath10k_warn(ar, "failed to parse swba event: %d\n", ret);
+                return;
+        }
+
+        map = __le32_to_cpu(arg.vdev_map);
 
         ath10k_dbg(ar, ATH10K_DBG_MGMT, "mgmt swba vdev_map 0x%x\n",
-                   ev->vdev_map);
+                   map);
 
         for (; map; map >>= 1, vdev_id++) {
                 if (!(map & 0x1))
@@ -1860,19 +2426,20 @@ static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
                         break;
                 }
 
-                bcn_info = &ev->bcn_info[i];
+                tim_info = arg.tim_info[i];
+                noa_info = arg.noa_info[i];
 
                 ath10k_dbg(ar, ATH10K_DBG_MGMT,
                            "mgmt event bcn_info %d tim_len %d mcast %d changed %d num_ps_pending %d bitmap 0x%08x%08x%08x%08x\n",
                            i,
-                           __le32_to_cpu(bcn_info->tim_info.tim_len),
-                           __le32_to_cpu(bcn_info->tim_info.tim_mcast),
-                           __le32_to_cpu(bcn_info->tim_info.tim_changed),
-                           __le32_to_cpu(bcn_info->tim_info.tim_num_ps_pending),
-                           __le32_to_cpu(bcn_info->tim_info.tim_bitmap[3]),
-                           __le32_to_cpu(bcn_info->tim_info.tim_bitmap[2]),
-                           __le32_to_cpu(bcn_info->tim_info.tim_bitmap[1]),
-                           __le32_to_cpu(bcn_info->tim_info.tim_bitmap[0]));
+                           __le32_to_cpu(tim_info->tim_len),
+                           __le32_to_cpu(tim_info->tim_mcast),
+                           __le32_to_cpu(tim_info->tim_changed),
+                           __le32_to_cpu(tim_info->tim_num_ps_pending),
+                           __le32_to_cpu(tim_info->tim_bitmap[3]),
+                           __le32_to_cpu(tim_info->tim_bitmap[2]),
+                           __le32_to_cpu(tim_info->tim_bitmap[1]),
+                           __le32_to_cpu(tim_info->tim_bitmap[0]));
 
                 arvif = ath10k_get_arvif(ar, vdev_id);
                 if (arvif == NULL) {
@@ -1899,15 +2466,25 @@ static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
                 }
 
                 ath10k_tx_h_seq_no(arvif->vif, bcn);
-                ath10k_wmi_update_tim(ar, arvif, bcn, bcn_info);
-                ath10k_wmi_update_noa(ar, arvif, bcn, bcn_info);
+                ath10k_wmi_update_tim(ar, arvif, bcn, tim_info);
+                ath10k_wmi_update_noa(ar, arvif, bcn, noa_info);
 
                 spin_lock_bh(&ar->data_lock);
 
                 if (arvif->beacon) {
-                        if (!arvif->beacon_sent)
-                                ath10k_warn(ar, "SWBA overrun on vdev %d\n",
+                        switch (arvif->beacon_state) {
+                        case ATH10K_BEACON_SENT:
+                                break;
+                        case ATH10K_BEACON_SCHEDULED:
+                                ath10k_warn(ar, "SWBA overrun on vdev %d, skipped old beacon\n",
+                                            arvif->vdev_id);
+                                break;
+                        case ATH10K_BEACON_SENDING:
+                                ath10k_warn(ar, "SWBA overrun on vdev %d, skipped new beacon\n",
                                             arvif->vdev_id);
+                                dev_kfree_skb(bcn);
+                                goto skip;
+                        }
 
                         ath10k_mac_vif_beacon_free(arvif);
                 }
@@ -1935,19 +2512,19 @@ static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
                 }
 
                 arvif->beacon = bcn;
-                arvif->beacon_sent = false;
+                arvif->beacon_state = ATH10K_BEACON_SCHEDULED;
 
                 trace_ath10k_tx_hdr(ar, bcn->data, bcn->len);
                 trace_ath10k_tx_payload(ar, bcn->data, bcn->len);
 
-                ath10k_wmi_tx_beacon_nowait(arvif);
 skip:
                 spin_unlock_bh(&ar->data_lock);
         }
+
+        ath10k_wmi_tx_beacons_nowait(ar);
 }
 
-static void ath10k_wmi_event_tbttoffset_update(struct ath10k *ar,
-                                               struct sk_buff *skb)
+void ath10k_wmi_event_tbttoffset_update(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_TBTTOFFSET_UPDATE_EVENTID\n");
 }
@@ -2068,9 +2645,9 @@ static int ath10k_dfs_fft_report(struct ath10k *ar,
         return 0;
 }
 
-static void ath10k_wmi_event_dfs(struct ath10k *ar,
-                                 const struct wmi_phyerr *phyerr,
-                                 u64 tsf)
+void ath10k_wmi_event_dfs(struct ath10k *ar,
+                          const struct wmi_phyerr *phyerr,
+                          u64 tsf)
 {
         int buf_len, tlv_len, res, i = 0;
         const struct phyerr_tlv *tlv;
@@ -2133,10 +2710,9 @@ static void ath10k_wmi_event_dfs(struct ath10k *ar,
         }
 }
 
-static void
-ath10k_wmi_event_spectral_scan(struct ath10k *ar,
-                               const struct wmi_phyerr *phyerr,
-                               u64 tsf)
+void ath10k_wmi_event_spectral_scan(struct ath10k *ar,
+                                    const struct wmi_phyerr *phyerr,
+                                    u64 tsf)
 {
         int buf_len, tlv_len, res, i = 0;
         struct phyerr_tlv *tlv;
@@ -2188,37 +2764,53 @@ ath10k_wmi_event_spectral_scan(struct ath10k *ar,
         }
 }
 
-static void ath10k_wmi_event_phyerr(struct ath10k *ar, struct sk_buff *skb)
+static int ath10k_wmi_op_pull_phyerr_ev(struct ath10k *ar, struct sk_buff *skb,
+                                        struct wmi_phyerr_ev_arg *arg)
 {
-        const struct wmi_phyerr_event *ev;
+        struct wmi_phyerr_event *ev = (void *)skb->data;
+
+        if (skb->len < sizeof(*ev))
+                return -EPROTO;
+
+        arg->num_phyerrs = ev->num_phyerrs;
+        arg->tsf_l32 = ev->tsf_l32;
+        arg->tsf_u32 = ev->tsf_u32;
+        arg->buf_len = __cpu_to_le32(skb->len - sizeof(*ev));
+        arg->phyerrs = ev->phyerrs;
+
+        return 0;
+}
+
+void ath10k_wmi_event_phyerr(struct ath10k *ar, struct sk_buff *skb)
+{
+        struct wmi_phyerr_ev_arg arg = {};
         const struct wmi_phyerr *phyerr;
         u32 count, i, buf_len, phy_err_code;
         u64 tsf;
-        int left_len = skb->len;
+        int left_len, ret;
 
         ATH10K_DFS_STAT_INC(ar, phy_errors);
 
-        /* Check if combined event available */
-        if (left_len < sizeof(*ev)) {
-                ath10k_warn(ar, "wmi phyerr combined event wrong len\n");
+        ret = ath10k_wmi_pull_phyerr(ar, skb, &arg);
+        if (ret) {
+                ath10k_warn(ar, "failed to parse phyerr event: %d\n", ret);
                 return;
         }
 
-        left_len -= sizeof(*ev);
+        left_len = __le32_to_cpu(arg.buf_len);
 
         /* Check number of included events */
-        ev = (const struct wmi_phyerr_event *)skb->data;
-        count = __le32_to_cpu(ev->num_phyerrs);
+        count = __le32_to_cpu(arg.num_phyerrs);
 
-        tsf = __le32_to_cpu(ev->tsf_u32);
+        tsf = __le32_to_cpu(arg.tsf_u32);
         tsf <<= 32;
-        tsf |= __le32_to_cpu(ev->tsf_l32);
+        tsf |= __le32_to_cpu(arg.tsf_l32);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi event phyerr count %d tsf64 0x%llX\n",
                    count, tsf);
 
-        phyerr = ev->phyerrs;
+        phyerr = arg.phyerrs;
         for (i = 0; i < count; i++) {
                 /* Check if we can read event header */
                 if (left_len < sizeof(*phyerr)) {
@@ -2258,19 +2850,17 @@ static void ath10k_wmi_event_phyerr(struct ath10k *ar, struct sk_buff *skb)
         }
 }
 
-static void ath10k_wmi_event_roam(struct ath10k *ar, struct sk_buff *skb)
+void ath10k_wmi_event_roam(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_ROAM_EVENTID\n");
 }
 
-static void ath10k_wmi_event_profile_match(struct ath10k *ar,
-                                           struct sk_buff *skb)
+void ath10k_wmi_event_profile_match(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_PROFILE_MATCH\n");
 }
 
-static void ath10k_wmi_event_debug_print(struct ath10k *ar,
-                                         struct sk_buff *skb)
+void ath10k_wmi_event_debug_print(struct ath10k *ar, struct sk_buff *skb)
 {
         char buf[101], c;
         int i;
@@ -2303,103 +2893,90 @@ static void ath10k_wmi_event_debug_print(struct ath10k *ar,
         ath10k_dbg(ar, ATH10K_DBG_WMI_PRINT, "wmi print '%s'\n", buf);
 }
 
-static void ath10k_wmi_event_pdev_qvit(struct ath10k *ar, struct sk_buff *skb)
+void ath10k_wmi_event_pdev_qvit(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_PDEV_QVIT_EVENTID\n");
 }
 
-static void ath10k_wmi_event_wlan_profile_data(struct ath10k *ar,
-                                               struct sk_buff *skb)
+void ath10k_wmi_event_wlan_profile_data(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_WLAN_PROFILE_DATA_EVENTID\n");
 }
 
-static void ath10k_wmi_event_rtt_measurement_report(struct ath10k *ar,
-                                                    struct sk_buff *skb)
+void ath10k_wmi_event_rtt_measurement_report(struct ath10k *ar,
+                                             struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_RTT_MEASUREMENT_REPORT_EVENTID\n");
 }
 
-static void ath10k_wmi_event_tsf_measurement_report(struct ath10k *ar,
-                                                    struct sk_buff *skb)
+void ath10k_wmi_event_tsf_measurement_report(struct ath10k *ar,
+                                             struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_TSF_MEASUREMENT_REPORT_EVENTID\n");
 }
 
-static void ath10k_wmi_event_rtt_error_report(struct ath10k *ar,
-                                              struct sk_buff *skb)
+void ath10k_wmi_event_rtt_error_report(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_RTT_ERROR_REPORT_EVENTID\n");
 }
 
-static void ath10k_wmi_event_wow_wakeup_host(struct ath10k *ar,
-                                             struct sk_buff *skb)
+void ath10k_wmi_event_wow_wakeup_host(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_WOW_WAKEUP_HOST_EVENTID\n");
 }
 
-static void ath10k_wmi_event_dcs_interference(struct ath10k *ar,
-                                              struct sk_buff *skb)
+void ath10k_wmi_event_dcs_interference(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_DCS_INTERFERENCE_EVENTID\n");
 }
 
-static void ath10k_wmi_event_pdev_tpc_config(struct ath10k *ar,
-                                             struct sk_buff *skb)
+void ath10k_wmi_event_pdev_tpc_config(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_PDEV_TPC_CONFIG_EVENTID\n");
 }
 
-static void ath10k_wmi_event_pdev_ftm_intg(struct ath10k *ar,
-                                           struct sk_buff *skb)
+void ath10k_wmi_event_pdev_ftm_intg(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_PDEV_FTM_INTG_EVENTID\n");
 }
 
-static void ath10k_wmi_event_gtk_offload_status(struct ath10k *ar,
-                                                struct sk_buff *skb)
+void ath10k_wmi_event_gtk_offload_status(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_GTK_OFFLOAD_STATUS_EVENTID\n");
 }
 
-static void ath10k_wmi_event_gtk_rekey_fail(struct ath10k *ar,
-                                            struct sk_buff *skb)
+void ath10k_wmi_event_gtk_rekey_fail(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_GTK_REKEY_FAIL_EVENTID\n");
 }
 
-static void ath10k_wmi_event_delba_complete(struct ath10k *ar,
-                                            struct sk_buff *skb)
+void ath10k_wmi_event_delba_complete(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_TX_DELBA_COMPLETE_EVENTID\n");
 }
 
-static void ath10k_wmi_event_addba_complete(struct ath10k *ar,
-                                            struct sk_buff *skb)
+void ath10k_wmi_event_addba_complete(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_TX_ADDBA_COMPLETE_EVENTID\n");
 }
 
-static void ath10k_wmi_event_vdev_install_key_complete(struct ath10k *ar,
-                                                       struct sk_buff *skb)
+void ath10k_wmi_event_vdev_install_key_complete(struct ath10k *ar,
+                                                struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_VDEV_INSTALL_KEY_COMPLETE_EVENTID\n");
 }
 
-static void ath10k_wmi_event_inst_rssi_stats(struct ath10k *ar,
-                                             struct sk_buff *skb)
+void ath10k_wmi_event_inst_rssi_stats(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_INST_RSSI_STATS_EVENTID\n");
 }
 
-static void ath10k_wmi_event_vdev_standby_req(struct ath10k *ar,
-                                              struct sk_buff *skb)
+void ath10k_wmi_event_vdev_standby_req(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_VDEV_STANDBY_REQ_EVENTID\n");
 }
 
-static void ath10k_wmi_event_vdev_resume_req(struct ath10k *ar,
-                                             struct sk_buff *skb)
+void ath10k_wmi_event_vdev_resume_req(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_VDEV_RESUME_REQ_EVENTID\n");
 }
@@ -2435,8 +3012,9 @@ static int ath10k_wmi_alloc_host_mem(struct ath10k *ar, u32 req_id,
         return 0;
 }
 
-static int ath10k_wmi_main_pull_svc_rdy_ev(struct sk_buff *skb,
-                                           struct wmi_svc_rdy_ev_arg *arg)
+static int
+ath10k_wmi_main_op_pull_svc_rdy_ev(struct ath10k *ar, struct sk_buff *skb,
+                                   struct wmi_svc_rdy_ev_arg *arg)
 {
         struct wmi_service_ready_event *ev;
         size_t i, n;
@@ -2471,8 +3049,9 @@ static int ath10k_wmi_main_pull_svc_rdy_ev(struct sk_buff *skb,
         return 0;
 }
 
-static int ath10k_wmi_10x_pull_svc_rdy_ev(struct sk_buff *skb,
-                                          struct wmi_svc_rdy_ev_arg *arg)
+static int
+ath10k_wmi_10x_op_pull_svc_rdy_ev(struct ath10k *ar, struct sk_buff *skb,
+                                  struct wmi_svc_rdy_ev_arg *arg)
 {
         struct wmi_10x_service_ready_event *ev;
         int i, n;
@@ -2506,30 +3085,22 @@ static int ath10k_wmi_10x_pull_svc_rdy_ev(struct sk_buff *skb,
         return 0;
 }
 
-static void ath10k_wmi_event_service_ready(struct ath10k *ar,
-                                           struct sk_buff *skb)
+void ath10k_wmi_event_service_ready(struct ath10k *ar, struct sk_buff *skb)
 {
         struct wmi_svc_rdy_ev_arg arg = {};
         u32 num_units, req_id, unit_size, num_mem_reqs, num_unit_info, i;
         int ret;
 
-        memset(&ar->wmi.svc_map, 0, sizeof(ar->wmi.svc_map));
-
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                ret = ath10k_wmi_10x_pull_svc_rdy_ev(skb, &arg);
-                wmi_10x_svc_map(arg.service_map, ar->wmi.svc_map,
-                                arg.service_map_len);
-        } else {
-                ret = ath10k_wmi_main_pull_svc_rdy_ev(skb, &arg);
-                wmi_main_svc_map(arg.service_map, ar->wmi.svc_map,
-                                 arg.service_map_len);
-        }
-
+        ret = ath10k_wmi_pull_svc_rdy(ar, skb, &arg);
         if (ret) {
                 ath10k_warn(ar, "failed to parse service ready: %d\n", ret);
                 return;
         }
 
+        memset(&ar->wmi.svc_map, 0, sizeof(ar->wmi.svc_map));
+        ath10k_wmi_map_svc(ar, arg.service_map, ar->wmi.svc_map,
+                           arg.service_map_len);
+
         ar->hw_min_tx_power = __le32_to_cpu(arg.min_tx_power);
         ar->hw_max_tx_power = __le32_to_cpu(arg.max_tx_power);
         ar->ht_cap_info = __le32_to_cpu(arg.ht_cap);
@@ -2607,13 +3178,14 @@ static void ath10k_wmi_event_service_ready(struct ath10k *ar,
         }
 
         ath10k_dbg(ar, ATH10K_DBG_WMI,
-                   "wmi event service ready min_tx_power 0x%08x max_tx_power 0x%08x ht_cap 0x%08x vht_cap 0x%08x sw_ver0 0x%08x sw_ver1 0x%08x phy_capab 0x%08x num_rf_chains 0x%08x eeprom_rd 0x%08x num_mem_reqs 0x%08x\n",
+                   "wmi event service ready min_tx_power 0x%08x max_tx_power 0x%08x ht_cap 0x%08x vht_cap 0x%08x sw_ver0 0x%08x sw_ver1 0x%08x fw_build 0x%08x phy_capab 0x%08x num_rf_chains 0x%08x eeprom_rd 0x%08x num_mem_reqs 0x%08x\n",
                    __le32_to_cpu(arg.min_tx_power),
                    __le32_to_cpu(arg.max_tx_power),
                    __le32_to_cpu(arg.ht_cap),
                    __le32_to_cpu(arg.vht_cap),
                    __le32_to_cpu(arg.sw_ver0),
                    __le32_to_cpu(arg.sw_ver1),
+                   __le32_to_cpu(arg.fw_build),
                    __le32_to_cpu(arg.phy_capab),
                    __le32_to_cpu(arg.num_rf_chains),
                    __le32_to_cpu(arg.eeprom_rd),
@@ -2622,27 +3194,59 @@ static void ath10k_wmi_event_service_ready(struct ath10k *ar,
         complete(&ar->wmi.service_ready);
 }
 
-static int ath10k_wmi_event_ready(struct ath10k *ar, struct sk_buff *skb)
+static int ath10k_wmi_op_pull_rdy_ev(struct ath10k *ar, struct sk_buff *skb,
+                                     struct wmi_rdy_ev_arg *arg)
 {
-        struct wmi_ready_event *ev = (struct wmi_ready_event *)skb->data;
+        struct wmi_ready_event *ev = (void *)skb->data;
 
-        if (WARN_ON(skb->len < sizeof(*ev)))
-                return -EINVAL;
+        if (skb->len < sizeof(*ev))
+                return -EPROTO;
 
-        ether_addr_copy(ar->mac_addr, ev->mac_addr.addr);
+        skb_pull(skb, sizeof(*ev));
+        arg->sw_version = ev->sw_version;
+        arg->abi_version = ev->abi_version;
+        arg->status = ev->status;
+        arg->mac_addr = ev->mac_addr.addr;
+
+        return 0;
+}
+
+int ath10k_wmi_event_ready(struct ath10k *ar, struct sk_buff *skb)
+{
+        struct wmi_rdy_ev_arg arg = {};
+        int ret;
+
+        ret = ath10k_wmi_pull_rdy(ar, skb, &arg);
+        if (ret) {
+                ath10k_warn(ar, "failed to parse ready event: %d\n", ret);
+                return ret;
+        }
 
         ath10k_dbg(ar, ATH10K_DBG_WMI,
-                   "wmi event ready sw_version %u abi_version %u mac_addr %pM status %d skb->len %i ev-sz %zu\n",
-                   __le32_to_cpu(ev->sw_version),
-                   __le32_to_cpu(ev->abi_version),
-                   ev->mac_addr.addr,
-                   __le32_to_cpu(ev->status), skb->len, sizeof(*ev));
+                   "wmi event ready sw_version %u abi_version %u mac_addr %pM status %d\n",
+                   __le32_to_cpu(arg.sw_version),
+                   __le32_to_cpu(arg.abi_version),
+                   arg.mac_addr,
+                   __le32_to_cpu(arg.status));
 
+        ether_addr_copy(ar->mac_addr, arg.mac_addr);
         complete(&ar->wmi.unified_ready);
         return 0;
 }
 
-static void ath10k_wmi_main_process_rx(struct ath10k *ar, struct sk_buff *skb)
+static int ath10k_wmi_event_temperature(struct ath10k *ar, struct sk_buff *skb)
+{
+        const struct wmi_pdev_temperature_event *ev;
+
+        ev = (struct wmi_pdev_temperature_event *)skb->data;
+        if (WARN_ON(skb->len < sizeof(*ev)))
+                return -EPROTO;
+
+        ath10k_thermal_event_temperature(ar, __le32_to_cpu(ev->temperature));
+        return 0;
+}
+
+static void ath10k_wmi_op_rx(struct ath10k *ar, struct sk_buff *skb)
 {
         struct wmi_cmd_hdr *cmd_hdr;
         enum wmi_event_id id;
@@ -2758,7 +3362,7 @@ static void ath10k_wmi_main_process_rx(struct ath10k *ar, struct sk_buff *skb)
         dev_kfree_skb(skb);
 }
 
-static void ath10k_wmi_10x_process_rx(struct ath10k *ar, struct sk_buff *skb)
+static void ath10k_wmi_10_1_op_rx(struct ath10k *ar, struct sk_buff *skb)
 {
         struct wmi_cmd_hdr *cmd_hdr;
         enum wmi_10x_event_id id;
@@ -2882,7 +3486,7 @@ out:
         dev_kfree_skb(skb);
 }
 
-static void ath10k_wmi_10_2_process_rx(struct ath10k *ar, struct sk_buff *skb)
+static void ath10k_wmi_10_2_op_rx(struct ath10k *ar, struct sk_buff *skb)
 {
         struct wmi_cmd_hdr *cmd_hdr;
         enum wmi_10_2_event_id id;
@@ -2981,6 +3585,9 @@ static void ath10k_wmi_10_2_process_rx(struct ath10k *ar, struct sk_buff *skb)
         case WMI_10_2_READY_EVENTID:
                 ath10k_wmi_event_ready(ar, skb);
                 break;
+        case WMI_10_2_PDEV_TEMPERATURE_EVENTID:
+                ath10k_wmi_event_temperature(ar, skb);
+                break;
         case WMI_10_2_RTT_KEEPALIVE_EVENTID:
         case WMI_10_2_GPIO_INPUT_EVENTID:
         case WMI_10_2_PEER_RATECODE_LIST_EVENTID:
@@ -3001,14 +3608,11 @@ static void ath10k_wmi_10_2_process_rx(struct ath10k *ar, struct sk_buff *skb)
 
 static void ath10k_wmi_process_rx(struct ath10k *ar, struct sk_buff *skb)
 {
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                if (test_bit(ATH10K_FW_FEATURE_WMI_10_2, ar->fw_features))
-                        ath10k_wmi_10_2_process_rx(ar, skb);
-                else
-                        ath10k_wmi_10x_process_rx(ar, skb);
-        } else {
-                ath10k_wmi_main_process_rx(ar, skb);
-        }
+        int ret;
+
+        ret = ath10k_wmi_rx(ar, skb);
+        if (ret)
+                ath10k_warn(ar, "failed to process wmi rx: %d\n", ret);
 }
 
 int ath10k_wmi_connect(struct ath10k *ar)
@@ -3039,16 +3643,17 @@ int ath10k_wmi_connect(struct ath10k *ar)
         return 0;
 }
 
-static int ath10k_wmi_main_pdev_set_regdomain(struct ath10k *ar, u16 rd,
-                                              u16 rd2g, u16 rd5g, u16 ctl2g,
-                                              u16 ctl5g)
+static struct sk_buff *
+ath10k_wmi_op_gen_pdev_set_rd(struct ath10k *ar, u16 rd, u16 rd2g, u16 rd5g,
+                              u16 ctl2g, u16 ctl5g,
+                              enum wmi_dfs_region dfs_reg)
 {
         struct wmi_pdev_set_regdomain_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_pdev_set_regdomain_cmd *)skb->data;
         cmd->reg_domain = __cpu_to_le32(rd);
@@ -3060,22 +3665,20 @@ static int ath10k_wmi_main_pdev_set_regdomain(struct ath10k *ar, u16 rd,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi pdev regdomain rd %x rd2g %x rd5g %x ctl2g %x ctl5g %x\n",
                    rd, rd2g, rd5g, ctl2g, ctl5g);
-
-        return ath10k_wmi_cmd_send(ar, skb,
-                                   ar->wmi.cmd->pdev_set_regdomain_cmdid);
+        return skb;
 }
 
-static int ath10k_wmi_10x_pdev_set_regdomain(struct ath10k *ar, u16 rd,
-                                             u16 rd2g, u16 rd5g,
-                                             u16 ctl2g, u16 ctl5g,
-                                             enum wmi_dfs_region dfs_reg)
+static struct sk_buff *
+ath10k_wmi_10x_op_gen_pdev_set_rd(struct ath10k *ar, u16 rd, u16 rd2g, u16
+                                  rd5g, u16 ctl2g, u16 ctl5g,
+                                  enum wmi_dfs_region dfs_reg)
 {
         struct wmi_pdev_set_regdomain_cmd_10x *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_pdev_set_regdomain_cmd_10x *)skb->data;
         cmd->reg_domain = __cpu_to_le32(rd);
@@ -3088,50 +3691,39 @@ static int ath10k_wmi_10x_pdev_set_regdomain(struct ath10k *ar, u16 rd,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi pdev regdomain rd %x rd2g %x rd5g %x ctl2g %x ctl5g %x dfs_region %x\n",
                    rd, rd2g, rd5g, ctl2g, ctl5g, dfs_reg);
-
-        return ath10k_wmi_cmd_send(ar, skb,
-                                   ar->wmi.cmd->pdev_set_regdomain_cmdid);
-}
-
-int ath10k_wmi_pdev_set_regdomain(struct ath10k *ar, u16 rd, u16 rd2g,
-                                  u16 rd5g, u16 ctl2g, u16 ctl5g,
-                                  enum wmi_dfs_region dfs_reg)
-{
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features))
-                return ath10k_wmi_10x_pdev_set_regdomain(ar, rd, rd2g, rd5g,
-                                                        ctl2g, ctl5g, dfs_reg);
-        else
-                return ath10k_wmi_main_pdev_set_regdomain(ar, rd, rd2g, rd5g,
-                                                         ctl2g, ctl5g);
+        return skb;
 }
 
-int ath10k_wmi_pdev_suspend_target(struct ath10k *ar, u32 suspend_opt)
+static struct sk_buff *
+ath10k_wmi_op_gen_pdev_suspend(struct ath10k *ar, u32 suspend_opt)
 {
         struct wmi_pdev_suspend_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_pdev_suspend_cmd *)skb->data;
         cmd->suspend_opt = __cpu_to_le32(suspend_opt);
 
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->pdev_suspend_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_pdev_resume_target(struct ath10k *ar)
+static struct sk_buff *
+ath10k_wmi_op_gen_pdev_resume(struct ath10k *ar)
 {
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, 0);
-        if (skb == NULL)
-                return -ENOMEM;
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
 
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->pdev_resume_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_pdev_set_param(struct ath10k *ar, u32 id, u32 value)
+static struct sk_buff *
+ath10k_wmi_op_gen_pdev_set_param(struct ath10k *ar, u32 id, u32 value)
 {
         struct wmi_pdev_set_param_cmd *cmd;
         struct sk_buff *skb;
@@ -3139,12 +3731,12 @@ int ath10k_wmi_pdev_set_param(struct ath10k *ar, u32 id, u32 value)
         if (id == WMI_PDEV_PARAM_UNSUPPORTED) {
                 ath10k_warn(ar, "pdev param %d not supported by firmware\n",
                             id);
-                return -EOPNOTSUPP;
+                return ERR_PTR(-EOPNOTSUPP);
         }
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_pdev_set_param_cmd *)skb->data;
         cmd->param_id    = __cpu_to_le32(id);
@@ -3152,11 +3744,11 @@ int ath10k_wmi_pdev_set_param(struct ath10k *ar, u32 id, u32 value)
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi pdev set param %d value %d\n",
                    id, value);
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->pdev_set_param_cmdid);
+        return skb;
 }
 
-static void ath10k_wmi_put_host_mem_chunks(struct ath10k *ar,
-                                           struct wmi_host_mem_chunks *chunks)
+void ath10k_wmi_put_host_mem_chunks(struct ath10k *ar,
+                                    struct wmi_host_mem_chunks *chunks)
 {
         struct host_memory_chunk *chunk;
         int i;
@@ -3177,7 +3769,7 @@ static void ath10k_wmi_put_host_mem_chunks(struct ath10k *ar,
         }
 }
 
-static int ath10k_wmi_main_cmd_init(struct ath10k *ar)
+static struct sk_buff *ath10k_wmi_op_gen_init(struct ath10k *ar)
 {
         struct wmi_init_cmd *cmd;
         struct sk_buff *buf;
@@ -3240,7 +3832,7 @@ static int ath10k_wmi_main_cmd_init(struct ath10k *ar)
 
         buf = ath10k_wmi_alloc_skb(ar, len);
         if (!buf)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_init_cmd *)buf->data;
 
@@ -3248,10 +3840,10 @@ static int ath10k_wmi_main_cmd_init(struct ath10k *ar)
         ath10k_wmi_put_host_mem_chunks(ar, &cmd->mem_chunks);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi init\n");
-        return ath10k_wmi_cmd_send(ar, buf, ar->wmi.cmd->init_cmdid);
+        return buf;
 }
 
-static int ath10k_wmi_10x_cmd_init(struct ath10k *ar)
+static struct sk_buff *ath10k_wmi_10_1_op_gen_init(struct ath10k *ar)
 {
         struct wmi_init_cmd_10x *cmd;
         struct sk_buff *buf;
@@ -3306,7 +3898,7 @@ static int ath10k_wmi_10x_cmd_init(struct ath10k *ar)
 
         buf = ath10k_wmi_alloc_skb(ar, len);
         if (!buf)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_init_cmd_10x *)buf->data;
 
@@ -3314,15 +3906,15 @@ static int ath10k_wmi_10x_cmd_init(struct ath10k *ar)
         ath10k_wmi_put_host_mem_chunks(ar, &cmd->mem_chunks);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi init 10x\n");
-        return ath10k_wmi_cmd_send(ar, buf, ar->wmi.cmd->init_cmdid);
+        return buf;
 }
 
-static int ath10k_wmi_10_2_cmd_init(struct ath10k *ar)
+static struct sk_buff *ath10k_wmi_10_2_op_gen_init(struct ath10k *ar)
 {
         struct wmi_init_cmd_10_2 *cmd;
         struct sk_buff *buf;
         struct wmi_resource_config_10x config = {};
-        u32 len, val;
+        u32 len, val, features;
 
         config.num_vdevs = __cpu_to_le32(TARGET_10X_NUM_VDEVS);
         config.num_peers = __cpu_to_le32(TARGET_10X_NUM_PEERS);
@@ -3356,7 +3948,7 @@ static int ath10k_wmi_10_2_cmd_init(struct ath10k *ar)
         config.mcast2ucast_mode = __cpu_to_le32(TARGET_10X_MCAST2UCAST_MODE);
         config.tx_dbg_log_size = __cpu_to_le32(TARGET_10X_TX_DBG_LOG_SIZE);
         config.num_wds_entries = __cpu_to_le32(TARGET_10X_NUM_WDS_ENTRIES);
-        config.dma_burst_size = __cpu_to_le32(TARGET_10X_DMA_BURST_SIZE);
+        config.dma_burst_size = __cpu_to_le32(TARGET_10_2_DMA_BURST_SIZE);
         config.mac_aggr_delim = __cpu_to_le32(TARGET_10X_MAC_AGGR_DELIM);
 
         val = TARGET_10X_RX_SKIP_DEFRAG_TIMEOUT_DUP_DETECTION_CHECK;
@@ -3372,34 +3964,21 @@ static int ath10k_wmi_10_2_cmd_init(struct ath10k *ar)
 
         buf = ath10k_wmi_alloc_skb(ar, len);
         if (!buf)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_init_cmd_10_2 *)buf->data;
 
+        features = WMI_10_2_RX_BATCH_MODE;
+        cmd->resource_config.feature_mask = __cpu_to_le32(features);
+
         memcpy(&cmd->resource_config.common, &config, sizeof(config));
         ath10k_wmi_put_host_mem_chunks(ar, &cmd->mem_chunks);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi init 10.2\n");
-        return ath10k_wmi_cmd_send(ar, buf, ar->wmi.cmd->init_cmdid);
+        return buf;
 }
 
-int ath10k_wmi_cmd_init(struct ath10k *ar)
-{
-        int ret;
-
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                if (test_bit(ATH10K_FW_FEATURE_WMI_10_2, ar->fw_features))
-                        ret = ath10k_wmi_10_2_cmd_init(ar);
-                else
-                        ret = ath10k_wmi_10x_cmd_init(ar);
-        } else {
-                ret = ath10k_wmi_main_cmd_init(ar);
-        }
-
-        return ret;
-}
-
-static int ath10k_wmi_start_scan_verify(const struct wmi_start_scan_arg *arg)
+int ath10k_wmi_start_scan_verify(const struct wmi_start_scan_arg *arg)
 {
         if (arg->ie_len && !arg->ie)
                 return -EINVAL;
@@ -3450,9 +4029,8 @@ ath10k_wmi_start_scan_tlvs_len(const struct wmi_start_scan_arg *arg)
         return len;
 }
 
-static void
-ath10k_wmi_put_start_scan_common(struct wmi_start_scan_common *cmn,
-                                 const struct wmi_start_scan_arg *arg)
+void ath10k_wmi_put_start_scan_common(struct wmi_start_scan_common *cmn,
+                                      const struct wmi_start_scan_arg *arg)
 {
         u32 scan_id;
         u32 scan_req_id;
@@ -3546,46 +4124,60 @@ ath10k_wmi_put_start_scan_tlvs(struct wmi_start_scan_tlvs *tlvs,
         }
 }
 
-int ath10k_wmi_start_scan(struct ath10k *ar,
-                          const struct wmi_start_scan_arg *arg)
+static struct sk_buff *
+ath10k_wmi_op_gen_start_scan(struct ath10k *ar,
+                             const struct wmi_start_scan_arg *arg)
 {
+        struct wmi_start_scan_cmd *cmd;
         struct sk_buff *skb;
         size_t len;
         int ret;
 
         ret = ath10k_wmi_start_scan_verify(arg);
         if (ret)
-                return ret;
-
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features))
-                len = sizeof(struct wmi_10x_start_scan_cmd) +
-                      ath10k_wmi_start_scan_tlvs_len(arg);
-        else
-                len = sizeof(struct wmi_start_scan_cmd) +
-                      ath10k_wmi_start_scan_tlvs_len(arg);
+                return ERR_PTR(ret);
 
+        len = sizeof(*cmd) + ath10k_wmi_start_scan_tlvs_len(arg);
         skb = ath10k_wmi_alloc_skb(ar, len);
         if (!skb)
-                return -ENOMEM;
-
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                struct wmi_10x_start_scan_cmd *cmd;
+                return ERR_PTR(-ENOMEM);
 
-                cmd = (struct wmi_10x_start_scan_cmd *)skb->data;
-                ath10k_wmi_put_start_scan_common(&cmd->common, arg);
-                ath10k_wmi_put_start_scan_tlvs(&cmd->tlvs, arg);
-        } else {
-                struct wmi_start_scan_cmd *cmd;
+        cmd = (struct wmi_start_scan_cmd *)skb->data;
 
-                cmd = (struct wmi_start_scan_cmd *)skb->data;
-                cmd->burst_duration_ms = __cpu_to_le32(0);
+        ath10k_wmi_put_start_scan_common(&cmd->common, arg);
+        ath10k_wmi_put_start_scan_tlvs(&cmd->tlvs, arg);
 
-                ath10k_wmi_put_start_scan_common(&cmd->common, arg);
-                ath10k_wmi_put_start_scan_tlvs(&cmd->tlvs, arg);
-        }
+        cmd->burst_duration_ms = __cpu_to_le32(0);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi start scan\n");
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->start_scan_cmdid);
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_10x_op_gen_start_scan(struct ath10k *ar,
+                                 const struct wmi_start_scan_arg *arg)
+{
+        struct wmi_10x_start_scan_cmd *cmd;
+        struct sk_buff *skb;
+        size_t len;
+        int ret;
+
+        ret = ath10k_wmi_start_scan_verify(arg);
+        if (ret)
+                return ERR_PTR(ret);
+
+        len = sizeof(*cmd) + ath10k_wmi_start_scan_tlvs_len(arg);
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        cmd = (struct wmi_10x_start_scan_cmd *)skb->data;
+
+        ath10k_wmi_put_start_scan_common(&cmd->common, arg);
+        ath10k_wmi_put_start_scan_tlvs(&cmd->tlvs, arg);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi 10x start scan\n");
+        return skb;
 }
 
 void ath10k_wmi_start_scan_init(struct ath10k *ar,
@@ -3614,7 +4206,9 @@ void ath10k_wmi_start_scan_init(struct ath10k *ar,
         arg->bssids[0].bssid = "\xFF\xFF\xFF\xFF\xFF\xFF";
 }
 
-int ath10k_wmi_stop_scan(struct ath10k *ar, const struct wmi_stop_scan_arg *arg)
+static struct sk_buff *
+ath10k_wmi_op_gen_stop_scan(struct ath10k *ar,
+                            const struct wmi_stop_scan_arg *arg)
 {
         struct wmi_stop_scan_cmd *cmd;
         struct sk_buff *skb;
@@ -3622,13 +4216,13 @@ int ath10k_wmi_stop_scan(struct ath10k *ar, const struct wmi_stop_scan_arg *arg)
         u32 req_id;
 
         if (arg->req_id > 0xFFF)
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
         if (arg->req_type == WMI_SCAN_STOP_ONE && arg->u.scan_id > 0xFFF)
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         scan_id = arg->u.scan_id;
         scan_id |= WMI_HOST_SCAN_REQ_ID_PREFIX;
@@ -3645,20 +4239,21 @@ int ath10k_wmi_stop_scan(struct ath10k *ar, const struct wmi_stop_scan_arg *arg)
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi stop scan reqid %d req_type %d vdev/scan_id %d\n",
                    arg->req_id, arg->req_type, arg->u.scan_id);
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->stop_scan_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_vdev_create(struct ath10k *ar, u32 vdev_id,
-                           enum wmi_vdev_type type,
-                           enum wmi_vdev_subtype subtype,
-                           const u8 macaddr[ETH_ALEN])
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_create(struct ath10k *ar, u32 vdev_id,
+                              enum wmi_vdev_type type,
+                              enum wmi_vdev_subtype subtype,
+                              const u8 macaddr[ETH_ALEN])
 {
         struct wmi_vdev_create_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_vdev_create_cmd *)skb->data;
         cmd->vdev_id      = __cpu_to_le32(vdev_id);
@@ -3669,58 +4264,52 @@ int ath10k_wmi_vdev_create(struct ath10k *ar, u32 vdev_id,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "WMI vdev create: id %d type %d subtype %d macaddr %pM\n",
                    vdev_id, type, subtype, macaddr);
-
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_create_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_vdev_delete(struct ath10k *ar, u32 vdev_id)
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_delete(struct ath10k *ar, u32 vdev_id)
 {
         struct wmi_vdev_delete_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_vdev_delete_cmd *)skb->data;
         cmd->vdev_id = __cpu_to_le32(vdev_id);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "WMI vdev delete id %d\n", vdev_id);
-
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_delete_cmdid);
+        return skb;
 }
 
-static int
-ath10k_wmi_vdev_start_restart(struct ath10k *ar,
-                              const struct wmi_vdev_start_request_arg *arg,
-                              u32 cmd_id)
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_start(struct ath10k *ar,
+                             const struct wmi_vdev_start_request_arg *arg,
+                             bool restart)
 {
         struct wmi_vdev_start_request_cmd *cmd;
         struct sk_buff *skb;
         const char *cmdname;
         u32 flags = 0;
 
-        if (cmd_id != ar->wmi.cmd->vdev_start_request_cmdid &&
-            cmd_id != ar->wmi.cmd->vdev_restart_request_cmdid)
-                return -EINVAL;
         if (WARN_ON(arg->ssid && arg->ssid_len == 0))
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
         if (WARN_ON(arg->hidden_ssid && !arg->ssid))
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
         if (WARN_ON(arg->ssid_len > sizeof(cmd->ssid.ssid)))
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
 
-        if (cmd_id == ar->wmi.cmd->vdev_start_request_cmdid)
-                cmdname = "start";
-        else if (cmd_id == ar->wmi.cmd->vdev_restart_request_cmdid)
+        if (restart)
                 cmdname = "restart";
         else
-                return -EINVAL; /* should not happen, we already check cmd_id */
+                cmdname = "start";
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         if (arg->hidden_ssid)
                 flags |= WMI_VDEV_START_HIDDEN_SSID;
@@ -3749,50 +4338,36 @@ ath10k_wmi_vdev_start_restart(struct ath10k *ar,
                    flags, arg->channel.freq, arg->channel.mode,
                    cmd->chan.flags, arg->channel.max_power);
 
-        return ath10k_wmi_cmd_send(ar, skb, cmd_id);
-}
-
-int ath10k_wmi_vdev_start(struct ath10k *ar,
-                          const struct wmi_vdev_start_request_arg *arg)
-{
-        u32 cmd_id = ar->wmi.cmd->vdev_start_request_cmdid;
-
-        return ath10k_wmi_vdev_start_restart(ar, arg, cmd_id);
-}
-
-int ath10k_wmi_vdev_restart(struct ath10k *ar,
-                            const struct wmi_vdev_start_request_arg *arg)
-{
-        u32 cmd_id = ar->wmi.cmd->vdev_restart_request_cmdid;
-
-        return ath10k_wmi_vdev_start_restart(ar, arg, cmd_id);
+        return skb;
 }
 
-int ath10k_wmi_vdev_stop(struct ath10k *ar, u32 vdev_id)
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_stop(struct ath10k *ar, u32 vdev_id)
 {
         struct wmi_vdev_stop_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_vdev_stop_cmd *)skb->data;
         cmd->vdev_id = __cpu_to_le32(vdev_id);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi vdev stop id 0x%x\n", vdev_id);
-
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_stop_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_vdev_up(struct ath10k *ar, u32 vdev_id, u32 aid, const u8 *bssid)
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_up(struct ath10k *ar, u32 vdev_id, u32 aid,
+                          const u8 *bssid)
 {
         struct wmi_vdev_up_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_vdev_up_cmd *)skb->data;
         cmd->vdev_id       = __cpu_to_le32(vdev_id);
@@ -3802,30 +4377,30 @@ int ath10k_wmi_vdev_up(struct ath10k *ar, u32 vdev_id, u32 aid, const u8 *bssid)
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi mgmt vdev up id 0x%x assoc id %d bssid %pM\n",
                    vdev_id, aid, bssid);
-
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_up_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_vdev_down(struct ath10k *ar, u32 vdev_id)
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_down(struct ath10k *ar, u32 vdev_id)
 {
         struct wmi_vdev_down_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_vdev_down_cmd *)skb->data;
         cmd->vdev_id = __cpu_to_le32(vdev_id);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi mgmt vdev down id 0x%x\n", vdev_id);
-
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_down_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_vdev_set_param(struct ath10k *ar, u32 vdev_id,
-                              u32 param_id, u32 param_value)
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_set_param(struct ath10k *ar, u32 vdev_id,
+                                 u32 param_id, u32 param_value)
 {
         struct wmi_vdev_set_param_cmd *cmd;
         struct sk_buff *skb;
@@ -3834,12 +4409,12 @@ int ath10k_wmi_vdev_set_param(struct ath10k *ar, u32 vdev_id,
                 ath10k_dbg(ar, ATH10K_DBG_WMI,
                            "vdev param %d not supported by firmware\n",
                             param_id);
-                return -EOPNOTSUPP;
+                return ERR_PTR(-EOPNOTSUPP);
         }
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_vdev_set_param_cmd *)skb->data;
         cmd->vdev_id     = __cpu_to_le32(vdev_id);
@@ -3849,24 +4424,24 @@ int ath10k_wmi_vdev_set_param(struct ath10k *ar, u32 vdev_id,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi vdev id 0x%x set param %d value %d\n",
                    vdev_id, param_id, param_value);
-
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_set_param_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_vdev_install_key(struct ath10k *ar,
-                                const struct wmi_vdev_install_key_arg *arg)
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_install_key(struct ath10k *ar,
+                                   const struct wmi_vdev_install_key_arg *arg)
 {
         struct wmi_vdev_install_key_cmd *cmd;
         struct sk_buff *skb;
 
         if (arg->key_cipher == WMI_CIPHER_NONE && arg->key_data != NULL)
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
         if (arg->key_cipher != WMI_CIPHER_NONE && arg->key_data == NULL)
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd) + arg->key_len);
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_vdev_install_key_cmd *)skb->data;
         cmd->vdev_id       = __cpu_to_le32(arg->vdev_id);
@@ -3885,20 +4460,19 @@ int ath10k_wmi_vdev_install_key(struct ath10k *ar,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi vdev install key idx %d cipher %d len %d\n",
                    arg->key_idx, arg->key_cipher, arg->key_len);
-        return ath10k_wmi_cmd_send(ar, skb,
-                                   ar->wmi.cmd->vdev_install_key_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_vdev_spectral_conf(struct ath10k *ar,
-                                  const struct wmi_vdev_spectral_conf_arg *arg)
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_spectral_conf(struct ath10k *ar,
+                                     const struct wmi_vdev_spectral_conf_arg *arg)
 {
         struct wmi_vdev_spectral_conf_cmd *cmd;
         struct sk_buff *skb;
-        u32 cmdid;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_vdev_spectral_conf_cmd *)skb->data;
         cmd->vdev_id = __cpu_to_le32(arg->vdev_id);
@@ -3921,39 +4495,38 @@ int ath10k_wmi_vdev_spectral_conf(struct ath10k *ar,
         cmd->scan_dbm_adj = __cpu_to_le32(arg->scan_dbm_adj);
         cmd->scan_chn_mask = __cpu_to_le32(arg->scan_chn_mask);
 
-        cmdid = ar->wmi.cmd->vdev_spectral_scan_configure_cmdid;
-        return ath10k_wmi_cmd_send(ar, skb, cmdid);
+        return skb;
 }
 
-int ath10k_wmi_vdev_spectral_enable(struct ath10k *ar, u32 vdev_id, u32 trigger,
-                                    u32 enable)
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_spectral_enable(struct ath10k *ar, u32 vdev_id,
+                                       u32 trigger, u32 enable)
 {
         struct wmi_vdev_spectral_enable_cmd *cmd;
         struct sk_buff *skb;
-        u32 cmdid;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_vdev_spectral_enable_cmd *)skb->data;
         cmd->vdev_id = __cpu_to_le32(vdev_id);
         cmd->trigger_cmd = __cpu_to_le32(trigger);
         cmd->enable_cmd = __cpu_to_le32(enable);
 
-        cmdid = ar->wmi.cmd->vdev_spectral_scan_enable_cmdid;
-        return ath10k_wmi_cmd_send(ar, skb, cmdid);
+        return skb;
 }
 
-int ath10k_wmi_peer_create(struct ath10k *ar, u32 vdev_id,
-                           const u8 peer_addr[ETH_ALEN])
+static struct sk_buff *
+ath10k_wmi_op_gen_peer_create(struct ath10k *ar, u32 vdev_id,
+                              const u8 peer_addr[ETH_ALEN])
 {
         struct wmi_peer_create_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_peer_create_cmd *)skb->data;
         cmd->vdev_id = __cpu_to_le32(vdev_id);
@@ -3962,18 +4535,19 @@ int ath10k_wmi_peer_create(struct ath10k *ar, u32 vdev_id,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi peer create vdev_id %d peer_addr %pM\n",
                    vdev_id, peer_addr);
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_create_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_peer_delete(struct ath10k *ar, u32 vdev_id,
-                           const u8 peer_addr[ETH_ALEN])
+static struct sk_buff *
+ath10k_wmi_op_gen_peer_delete(struct ath10k *ar, u32 vdev_id,
+                              const u8 peer_addr[ETH_ALEN])
 {
         struct wmi_peer_delete_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_peer_delete_cmd *)skb->data;
         cmd->vdev_id = __cpu_to_le32(vdev_id);
@@ -3982,18 +4556,19 @@ int ath10k_wmi_peer_delete(struct ath10k *ar, u32 vdev_id,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi peer delete vdev_id %d peer_addr %pM\n",
                    vdev_id, peer_addr);
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_delete_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_peer_flush(struct ath10k *ar, u32 vdev_id,
-                          const u8 peer_addr[ETH_ALEN], u32 tid_bitmap)
+static struct sk_buff *
+ath10k_wmi_op_gen_peer_flush(struct ath10k *ar, u32 vdev_id,
+                             const u8 peer_addr[ETH_ALEN], u32 tid_bitmap)
 {
         struct wmi_peer_flush_tids_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_peer_flush_tids_cmd *)skb->data;
         cmd->vdev_id         = __cpu_to_le32(vdev_id);
@@ -4003,19 +4578,21 @@ int ath10k_wmi_peer_flush(struct ath10k *ar, u32 vdev_id,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi peer flush vdev_id %d peer_addr %pM tids %08x\n",
                    vdev_id, peer_addr, tid_bitmap);
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_flush_tids_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_peer_set_param(struct ath10k *ar, u32 vdev_id,
-                              const u8 *peer_addr, enum wmi_peer_param param_id,
-                              u32 param_value)
+static struct sk_buff *
+ath10k_wmi_op_gen_peer_set_param(struct ath10k *ar, u32 vdev_id,
+                                 const u8 *peer_addr,
+                                 enum wmi_peer_param param_id,
+                                 u32 param_value)
 {
         struct wmi_peer_set_param_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_peer_set_param_cmd *)skb->data;
         cmd->vdev_id     = __cpu_to_le32(vdev_id);
@@ -4026,19 +4603,19 @@ int ath10k_wmi_peer_set_param(struct ath10k *ar, u32 vdev_id,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi vdev %d peer 0x%pM set param %d value %d\n",
                    vdev_id, peer_addr, param_id, param_value);
-
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_set_param_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_set_psmode(struct ath10k *ar, u32 vdev_id,
-                          enum wmi_sta_ps_mode psmode)
+static struct sk_buff *
+ath10k_wmi_op_gen_set_psmode(struct ath10k *ar, u32 vdev_id,
+                             enum wmi_sta_ps_mode psmode)
 {
         struct wmi_sta_powersave_mode_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_sta_powersave_mode_cmd *)skb->data;
         cmd->vdev_id     = __cpu_to_le32(vdev_id);
@@ -4047,21 +4624,20 @@ int ath10k_wmi_set_psmode(struct ath10k *ar, u32 vdev_id,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi set powersave id 0x%x mode %d\n",
                    vdev_id, psmode);
-
-        return ath10k_wmi_cmd_send(ar, skb,
-                                   ar->wmi.cmd->sta_powersave_mode_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_set_sta_ps_param(struct ath10k *ar, u32 vdev_id,
-                                enum wmi_sta_powersave_param param_id,
-                                u32 value)
+static struct sk_buff *
+ath10k_wmi_op_gen_set_sta_ps(struct ath10k *ar, u32 vdev_id,
+                             enum wmi_sta_powersave_param param_id,
+                             u32 value)
 {
         struct wmi_sta_powersave_param_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_sta_powersave_param_cmd *)skb->data;
         cmd->vdev_id     = __cpu_to_le32(vdev_id);
@@ -4071,22 +4647,22 @@ int ath10k_wmi_set_sta_ps_param(struct ath10k *ar, u32 vdev_id,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi sta ps param vdev_id 0x%x param %d value %d\n",
                    vdev_id, param_id, value);
-        return ath10k_wmi_cmd_send(ar, skb,
-                                   ar->wmi.cmd->sta_powersave_param_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_set_ap_ps_param(struct ath10k *ar, u32 vdev_id, const u8 *mac,
-                               enum wmi_ap_ps_peer_param param_id, u32 value)
+static struct sk_buff *
+ath10k_wmi_op_gen_set_ap_ps(struct ath10k *ar, u32 vdev_id, const u8 *mac,
+                            enum wmi_ap_ps_peer_param param_id, u32 value)
 {
         struct wmi_ap_ps_peer_cmd *cmd;
         struct sk_buff *skb;
 
         if (!mac)
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_ap_ps_peer_cmd *)skb->data;
         cmd->vdev_id = __cpu_to_le32(vdev_id);
@@ -4097,13 +4673,12 @@ int ath10k_wmi_set_ap_ps_param(struct ath10k *ar, u32 vdev_id, const u8 *mac,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi ap ps param vdev_id 0x%X param %d value %d mac_addr %pM\n",
                    vdev_id, param_id, value, mac);
-
-        return ath10k_wmi_cmd_send(ar, skb,
-                                   ar->wmi.cmd->ap_ps_peer_param_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_scan_chan_list(struct ath10k *ar,
-                              const struct wmi_scan_chan_list_arg *arg)
+static struct sk_buff *
+ath10k_wmi_op_gen_scan_chan_list(struct ath10k *ar,
+                                 const struct wmi_scan_chan_list_arg *arg)
 {
         struct wmi_scan_chan_list_cmd *cmd;
         struct sk_buff *skb;
@@ -4116,7 +4691,7 @@ int ath10k_wmi_scan_chan_list(struct ath10k *ar,
 
         skb = ath10k_wmi_alloc_skb(ar, len);
         if (!skb)
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
 
         cmd = (struct wmi_scan_chan_list_cmd *)skb->data;
         cmd->num_scan_chans = __cpu_to_le32(arg->n_channels);
@@ -4128,7 +4703,7 @@ int ath10k_wmi_scan_chan_list(struct ath10k *ar,
                 ath10k_wmi_put_wmi_channel(ci, ch);
         }
 
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->scan_chan_list_cmdid);
+        return skb;
 }
 
 static void
@@ -4209,12 +4784,9 @@ ath10k_wmi_peer_assoc_fill_10_2(struct ath10k *ar, void *buf,
         cmd->info0 = __cpu_to_le32(info0);
 }
 
-int ath10k_wmi_peer_assoc(struct ath10k *ar,
-                          const struct wmi_peer_assoc_complete_arg *arg)
+static int
+ath10k_wmi_peer_assoc_check_arg(const struct wmi_peer_assoc_complete_arg *arg)
 {
-        struct sk_buff *skb;
-        int len;
-
         if (arg->peer_mpdu_density > 16)
                 return -EINVAL;
         if (arg->peer_legacy_rates.num_rates > MAX_SUPPORTED_RATES)
@@ -4222,79 +4794,135 @@ int ath10k_wmi_peer_assoc(struct ath10k *ar,
         if (arg->peer_ht_rates.num_rates > MAX_SUPPORTED_RATES)
                 return -EINVAL;
 
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                if (test_bit(ATH10K_FW_FEATURE_WMI_10_2, ar->fw_features))
-                        len = sizeof(struct wmi_10_2_peer_assoc_complete_cmd);
-                else
-                        len = sizeof(struct wmi_10_1_peer_assoc_complete_cmd);
-        } else {
-                len = sizeof(struct wmi_main_peer_assoc_complete_cmd);
-        }
+        return 0;
+}
+
+static struct sk_buff *
+ath10k_wmi_op_gen_peer_assoc(struct ath10k *ar,
+                             const struct wmi_peer_assoc_complete_arg *arg)
+{
+        size_t len = sizeof(struct wmi_main_peer_assoc_complete_cmd);
+        struct sk_buff *skb;
+        int ret;
+
+        ret = ath10k_wmi_peer_assoc_check_arg(arg);
+        if (ret)
+                return ERR_PTR(ret);
 
         skb = ath10k_wmi_alloc_skb(ar, len);
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                if (test_bit(ATH10K_FW_FEATURE_WMI_10_2, ar->fw_features))
-                        ath10k_wmi_peer_assoc_fill_10_2(ar, skb->data, arg);
-                else
-                        ath10k_wmi_peer_assoc_fill_10_1(ar, skb->data, arg);
-        } else {
-                ath10k_wmi_peer_assoc_fill_main(ar, skb->data, arg);
-        }
+        ath10k_wmi_peer_assoc_fill_main(ar, skb->data, arg);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                   "wmi peer assoc vdev %d addr %pM (%s)\n",
+                   arg->vdev_id, arg->addr,
+                   arg->peer_reassoc ? "reassociate" : "new");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_10_1_op_gen_peer_assoc(struct ath10k *ar,
+                                  const struct wmi_peer_assoc_complete_arg *arg)
+{
+        size_t len = sizeof(struct wmi_10_1_peer_assoc_complete_cmd);
+        struct sk_buff *skb;
+        int ret;
+
+        ret = ath10k_wmi_peer_assoc_check_arg(arg);
+        if (ret)
+                return ERR_PTR(ret);
+
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ath10k_wmi_peer_assoc_fill_10_1(ar, skb->data, arg);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                   "wmi peer assoc vdev %d addr %pM (%s)\n",
+                   arg->vdev_id, arg->addr,
+                   arg->peer_reassoc ? "reassociate" : "new");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_10_2_op_gen_peer_assoc(struct ath10k *ar,
+                                  const struct wmi_peer_assoc_complete_arg *arg)
+{
+        size_t len = sizeof(struct wmi_10_2_peer_assoc_complete_cmd);
+        struct sk_buff *skb;
+        int ret;
+
+        ret = ath10k_wmi_peer_assoc_check_arg(arg);
+        if (ret)
+                return ERR_PTR(ret);
+
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ath10k_wmi_peer_assoc_fill_10_2(ar, skb->data, arg);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi peer assoc vdev %d addr %pM (%s)\n",
                    arg->vdev_id, arg->addr,
                    arg->peer_reassoc ? "reassociate" : "new");
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_assoc_cmdid);
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_10_2_op_gen_pdev_get_temperature(struct ath10k *ar)
+{
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, 0);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi pdev get temperature\n");
+        return skb;
 }
 
 /* This function assumes the beacon is already DMA mapped */
-int ath10k_wmi_beacon_send_ref_nowait(struct ath10k_vif *arvif)
+static struct sk_buff *
+ath10k_wmi_op_gen_beacon_dma(struct ath10k *ar, u32 vdev_id, const void *bcn,
+                             size_t bcn_len, u32 bcn_paddr, bool dtim_zero,
+                             bool deliver_cab)
 {
         struct wmi_bcn_tx_ref_cmd *cmd;
         struct sk_buff *skb;
-        struct sk_buff *beacon = arvif->beacon;
-        struct ath10k *ar = arvif->ar;
         struct ieee80211_hdr *hdr;
-        int ret;
         u16 fc;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
-        hdr = (struct ieee80211_hdr *)beacon->data;
+        hdr = (struct ieee80211_hdr *)bcn;
         fc = le16_to_cpu(hdr->frame_control);
 
         cmd = (struct wmi_bcn_tx_ref_cmd *)skb->data;
-        cmd->vdev_id = __cpu_to_le32(arvif->vdev_id);
-        cmd->data_len = __cpu_to_le32(beacon->len);
-        cmd->data_ptr = __cpu_to_le32(ATH10K_SKB_CB(beacon)->paddr);
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->data_len = __cpu_to_le32(bcn_len);
+        cmd->data_ptr = __cpu_to_le32(bcn_paddr);
         cmd->msdu_id = 0;
         cmd->frame_control = __cpu_to_le32(fc);
         cmd->flags = 0;
         cmd->antenna_mask = __cpu_to_le32(WMI_BCN_TX_REF_DEF_ANTENNA);
 
-        if (ATH10K_SKB_CB(beacon)->bcn.dtim_zero)
+        if (dtim_zero)
                 cmd->flags |= __cpu_to_le32(WMI_BCN_TX_REF_FLAG_DTIM_ZERO);
 
-        if (ATH10K_SKB_CB(beacon)->bcn.deliver_cab)
+        if (deliver_cab)
                 cmd->flags |= __cpu_to_le32(WMI_BCN_TX_REF_FLAG_DELIVER_CAB);
 
-        ret = ath10k_wmi_cmd_send_nowait(ar, skb,
-                                         ar->wmi.cmd->pdev_send_bcn_cmdid);
-
-        if (ret)
-                dev_kfree_skb(skb);
-
-        return ret;
+        return skb;
 }
 
-static void ath10k_wmi_pdev_set_wmm_param(struct wmi_wmm_params *params,
-                                          const struct wmi_wmm_params_arg *arg)
+void ath10k_wmi_set_wmm_param(struct wmi_wmm_params *params,
+                              const struct wmi_wmm_params_arg *arg)
 {
         params->cwmin  = __cpu_to_le32(arg->cwmin);
         params->cwmax  = __cpu_to_le32(arg->cwmax);
@@ -4304,52 +4932,54 @@ static void ath10k_wmi_pdev_set_wmm_param(struct wmi_wmm_params *params,
         params->no_ack = __cpu_to_le32(arg->no_ack);
 }
 
-int ath10k_wmi_pdev_set_wmm_params(struct ath10k *ar,
-                                   const struct wmi_pdev_set_wmm_params_arg *arg)
+static struct sk_buff *
+ath10k_wmi_op_gen_pdev_set_wmm(struct ath10k *ar,
+                               const struct wmi_wmm_params_all_arg *arg)
 {
         struct wmi_pdev_set_wmm_params *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_pdev_set_wmm_params *)skb->data;
-        ath10k_wmi_pdev_set_wmm_param(&cmd->ac_be, &arg->ac_be);
-        ath10k_wmi_pdev_set_wmm_param(&cmd->ac_bk, &arg->ac_bk);
-        ath10k_wmi_pdev_set_wmm_param(&cmd->ac_vi, &arg->ac_vi);
-        ath10k_wmi_pdev_set_wmm_param(&cmd->ac_vo, &arg->ac_vo);
+        ath10k_wmi_set_wmm_param(&cmd->ac_be, &arg->ac_be);
+        ath10k_wmi_set_wmm_param(&cmd->ac_bk, &arg->ac_bk);
+        ath10k_wmi_set_wmm_param(&cmd->ac_vi, &arg->ac_vi);
+        ath10k_wmi_set_wmm_param(&cmd->ac_vo, &arg->ac_vo);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi pdev set wmm params\n");
-        return ath10k_wmi_cmd_send(ar, skb,
-                                   ar->wmi.cmd->pdev_set_wmm_params_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_request_stats(struct ath10k *ar, enum wmi_stats_id stats_id)
+static struct sk_buff *
+ath10k_wmi_op_gen_request_stats(struct ath10k *ar, enum wmi_stats_id stats_id)
 {
         struct wmi_request_stats_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_request_stats_cmd *)skb->data;
         cmd->stats_id = __cpu_to_le32(stats_id);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi request stats %d\n", (int)stats_id);
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->request_stats_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_force_fw_hang(struct ath10k *ar,
-                             enum wmi_force_fw_hang_type type, u32 delay_ms)
+static struct sk_buff *
+ath10k_wmi_op_gen_force_fw_hang(struct ath10k *ar,
+                                enum wmi_force_fw_hang_type type, u32 delay_ms)
 {
         struct wmi_force_fw_hang_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_force_fw_hang_cmd *)skb->data;
         cmd->type = __cpu_to_le32(type);
@@ -4357,10 +4987,12 @@ int ath10k_wmi_force_fw_hang(struct ath10k *ar,
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi force fw hang %d delay %d\n",
                    type, delay_ms);
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->force_fw_hang_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_dbglog_cfg(struct ath10k *ar, u32 module_enable)
+static struct sk_buff *
+ath10k_wmi_op_gen_dbglog_cfg(struct ath10k *ar, u32 module_enable,
+                             u32 log_level)
 {
         struct wmi_dbglog_cfg_cmd *cmd;
         struct sk_buff *skb;
@@ -4368,12 +5000,12 @@ int ath10k_wmi_dbglog_cfg(struct ath10k *ar, u32 module_enable)
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_dbglog_cfg_cmd *)skb->data;
 
         if (module_enable) {
-                cfg = SM(ATH10K_DBGLOG_LEVEL_VERBOSE,
+                cfg = SM(log_level,
                          ATH10K_DBGLOG_CFG_LOG_LVL);
         } else {
                 /* set back defaults, all modules with WARN level */
@@ -4393,57 +5025,449 @@ int ath10k_wmi_dbglog_cfg(struct ath10k *ar, u32 module_enable)
                    __le32_to_cpu(cmd->module_valid),
                    __le32_to_cpu(cmd->config_enable),
                    __le32_to_cpu(cmd->config_valid));
-
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->dbglog_cfg_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_pdev_pktlog_enable(struct ath10k *ar, u32 ev_bitmap)
+static struct sk_buff *
+ath10k_wmi_op_gen_pktlog_enable(struct ath10k *ar, u32 ev_bitmap)
 {
         struct wmi_pdev_pktlog_enable_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         ev_bitmap &= ATH10K_PKTLOG_ANY;
-        ath10k_dbg(ar, ATH10K_DBG_WMI,
-                   "wmi enable pktlog filter:%x\n", ev_bitmap);
 
         cmd = (struct wmi_pdev_pktlog_enable_cmd *)skb->data;
         cmd->ev_bitmap = __cpu_to_le32(ev_bitmap);
-        return ath10k_wmi_cmd_send(ar, skb,
-                                   ar->wmi.cmd->pdev_pktlog_enable_cmdid);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi enable pktlog filter 0x%08x\n",
+                   ev_bitmap);
+        return skb;
 }
 
-int ath10k_wmi_pdev_pktlog_disable(struct ath10k *ar)
+static struct sk_buff *
+ath10k_wmi_op_gen_pktlog_disable(struct ath10k *ar)
 {
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, 0);
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi disable pktlog\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_op_gen_pdev_set_quiet_mode(struct ath10k *ar, u32 period,
+                                      u32 duration, u32 next_offset,
+                                      u32 enabled)
+{
+        struct wmi_pdev_set_quiet_cmd *cmd;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        cmd = (struct wmi_pdev_set_quiet_cmd *)skb->data;
+        cmd->period = __cpu_to_le32(period);
+        cmd->duration = __cpu_to_le32(duration);
+        cmd->next_start = __cpu_to_le32(next_offset);
+        cmd->enabled = __cpu_to_le32(enabled);
 
-        return ath10k_wmi_cmd_send(ar, skb,
-                                   ar->wmi.cmd->pdev_pktlog_disable_cmdid);
+        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                   "wmi quiet param: period %u duration %u enabled %d\n",
+                   period, duration, enabled);
+        return skb;
 }
 
-int ath10k_wmi_attach(struct ath10k *ar)
+static struct sk_buff *
+ath10k_wmi_op_gen_addba_clear_resp(struct ath10k *ar, u32 vdev_id,
+                                   const u8 *mac)
 {
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                if (test_bit(ATH10K_FW_FEATURE_WMI_10_2, ar->fw_features))
-                        ar->wmi.cmd = &wmi_10_2_cmd_map;
-                else
-                        ar->wmi.cmd = &wmi_10x_cmd_map;
+        struct wmi_addba_clear_resp_cmd *cmd;
+        struct sk_buff *skb;
+
+        if (!mac)
+                return ERR_PTR(-EINVAL);
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        cmd = (struct wmi_addba_clear_resp_cmd *)skb->data;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        ether_addr_copy(cmd->peer_macaddr.addr, mac);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                   "wmi addba clear resp vdev_id 0x%X mac_addr %pM\n",
+                   vdev_id, mac);
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_op_gen_addba_send(struct ath10k *ar, u32 vdev_id, const u8 *mac,
+                             u32 tid, u32 buf_size)
+{
+        struct wmi_addba_send_cmd *cmd;
+        struct sk_buff *skb;
+
+        if (!mac)
+                return ERR_PTR(-EINVAL);
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        cmd = (struct wmi_addba_send_cmd *)skb->data;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        ether_addr_copy(cmd->peer_macaddr.addr, mac);
+        cmd->tid = __cpu_to_le32(tid);
+        cmd->buffersize = __cpu_to_le32(buf_size);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                   "wmi addba send vdev_id 0x%X mac_addr %pM tid %u bufsize %u\n",
+                   vdev_id, mac, tid, buf_size);
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_op_gen_addba_set_resp(struct ath10k *ar, u32 vdev_id, const u8 *mac,
+                                 u32 tid, u32 status)
+{
+        struct wmi_addba_setresponse_cmd *cmd;
+        struct sk_buff *skb;
+
+        if (!mac)
+                return ERR_PTR(-EINVAL);
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        cmd = (struct wmi_addba_setresponse_cmd *)skb->data;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        ether_addr_copy(cmd->peer_macaddr.addr, mac);
+        cmd->tid = __cpu_to_le32(tid);
+        cmd->statuscode = __cpu_to_le32(status);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                   "wmi addba set resp vdev_id 0x%X mac_addr %pM tid %u status %u\n",
+                   vdev_id, mac, tid, status);
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_op_gen_delba_send(struct ath10k *ar, u32 vdev_id, const u8 *mac,
+                             u32 tid, u32 initiator, u32 reason)
+{
+        struct wmi_delba_send_cmd *cmd;
+        struct sk_buff *skb;
+
+        if (!mac)
+                return ERR_PTR(-EINVAL);
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        cmd = (struct wmi_delba_send_cmd *)skb->data;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        ether_addr_copy(cmd->peer_macaddr.addr, mac);
+        cmd->tid = __cpu_to_le32(tid);
+        cmd->initiator = __cpu_to_le32(initiator);
+        cmd->reasoncode = __cpu_to_le32(reason);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                   "wmi delba send vdev_id 0x%X mac_addr %pM tid %u initiator %u reason %u\n",
+                   vdev_id, mac, tid, initiator, reason);
+        return skb;
+}
+
+static const struct wmi_ops wmi_ops = {
+        .rx = ath10k_wmi_op_rx,
+        .map_svc = wmi_main_svc_map,
+
+        .pull_scan = ath10k_wmi_op_pull_scan_ev,
+        .pull_mgmt_rx = ath10k_wmi_op_pull_mgmt_rx_ev,
+        .pull_ch_info = ath10k_wmi_op_pull_ch_info_ev,
+        .pull_vdev_start = ath10k_wmi_op_pull_vdev_start_ev,
+        .pull_peer_kick = ath10k_wmi_op_pull_peer_kick_ev,
+        .pull_swba = ath10k_wmi_op_pull_swba_ev,
+        .pull_phyerr = ath10k_wmi_op_pull_phyerr_ev,
+        .pull_svc_rdy = ath10k_wmi_main_op_pull_svc_rdy_ev,
+        .pull_rdy = ath10k_wmi_op_pull_rdy_ev,
+        .pull_fw_stats = ath10k_wmi_main_op_pull_fw_stats,
+
+        .gen_pdev_suspend = ath10k_wmi_op_gen_pdev_suspend,
+        .gen_pdev_resume = ath10k_wmi_op_gen_pdev_resume,
+        .gen_pdev_set_rd = ath10k_wmi_op_gen_pdev_set_rd,
+        .gen_pdev_set_param = ath10k_wmi_op_gen_pdev_set_param,
+        .gen_init = ath10k_wmi_op_gen_init,
+        .gen_start_scan = ath10k_wmi_op_gen_start_scan,
+        .gen_stop_scan = ath10k_wmi_op_gen_stop_scan,
+        .gen_vdev_create = ath10k_wmi_op_gen_vdev_create,
+        .gen_vdev_delete = ath10k_wmi_op_gen_vdev_delete,
+        .gen_vdev_start = ath10k_wmi_op_gen_vdev_start,
+        .gen_vdev_stop = ath10k_wmi_op_gen_vdev_stop,
+        .gen_vdev_up = ath10k_wmi_op_gen_vdev_up,
+        .gen_vdev_down = ath10k_wmi_op_gen_vdev_down,
+        .gen_vdev_set_param = ath10k_wmi_op_gen_vdev_set_param,
+        .gen_vdev_install_key = ath10k_wmi_op_gen_vdev_install_key,
+        .gen_vdev_spectral_conf = ath10k_wmi_op_gen_vdev_spectral_conf,
+        .gen_vdev_spectral_enable = ath10k_wmi_op_gen_vdev_spectral_enable,
+        /* .gen_vdev_wmm_conf not implemented */
+        .gen_peer_create = ath10k_wmi_op_gen_peer_create,
+        .gen_peer_delete = ath10k_wmi_op_gen_peer_delete,
+        .gen_peer_flush = ath10k_wmi_op_gen_peer_flush,
+        .gen_peer_set_param = ath10k_wmi_op_gen_peer_set_param,
+        .gen_peer_assoc = ath10k_wmi_op_gen_peer_assoc,
+        .gen_set_psmode = ath10k_wmi_op_gen_set_psmode,
+        .gen_set_sta_ps = ath10k_wmi_op_gen_set_sta_ps,
+        .gen_set_ap_ps = ath10k_wmi_op_gen_set_ap_ps,
+        .gen_scan_chan_list = ath10k_wmi_op_gen_scan_chan_list,
+        .gen_beacon_dma = ath10k_wmi_op_gen_beacon_dma,
+        .gen_pdev_set_wmm = ath10k_wmi_op_gen_pdev_set_wmm,
+        .gen_request_stats = ath10k_wmi_op_gen_request_stats,
+        .gen_force_fw_hang = ath10k_wmi_op_gen_force_fw_hang,
+        .gen_mgmt_tx = ath10k_wmi_op_gen_mgmt_tx,
+        .gen_dbglog_cfg = ath10k_wmi_op_gen_dbglog_cfg,
+        .gen_pktlog_enable = ath10k_wmi_op_gen_pktlog_enable,
+        .gen_pktlog_disable = ath10k_wmi_op_gen_pktlog_disable,
+        .gen_pdev_set_quiet_mode = ath10k_wmi_op_gen_pdev_set_quiet_mode,
+        /* .gen_pdev_get_temperature not implemented */
+        .gen_addba_clear_resp = ath10k_wmi_op_gen_addba_clear_resp,
+        .gen_addba_send = ath10k_wmi_op_gen_addba_send,
+        .gen_addba_set_resp = ath10k_wmi_op_gen_addba_set_resp,
+        .gen_delba_send = ath10k_wmi_op_gen_delba_send,
+        /* .gen_bcn_tmpl not implemented */
+        /* .gen_prb_tmpl not implemented */
+        /* .gen_p2p_go_bcn_ie not implemented */
+};
+
+static const struct wmi_ops wmi_10_1_ops = {
+        .rx = ath10k_wmi_10_1_op_rx,
+        .map_svc = wmi_10x_svc_map,
+        .pull_svc_rdy = ath10k_wmi_10x_op_pull_svc_rdy_ev,
+        .pull_fw_stats = ath10k_wmi_10x_op_pull_fw_stats,
+        .gen_init = ath10k_wmi_10_1_op_gen_init,
+        .gen_pdev_set_rd = ath10k_wmi_10x_op_gen_pdev_set_rd,
+        .gen_start_scan = ath10k_wmi_10x_op_gen_start_scan,
+        .gen_peer_assoc = ath10k_wmi_10_1_op_gen_peer_assoc,
+        /* .gen_pdev_get_temperature not implemented */
+
+        /* shared with main branch */
+        .pull_scan = ath10k_wmi_op_pull_scan_ev,
+        .pull_mgmt_rx = ath10k_wmi_op_pull_mgmt_rx_ev,
+        .pull_ch_info = ath10k_wmi_op_pull_ch_info_ev,
+        .pull_vdev_start = ath10k_wmi_op_pull_vdev_start_ev,
+        .pull_peer_kick = ath10k_wmi_op_pull_peer_kick_ev,
+        .pull_swba = ath10k_wmi_op_pull_swba_ev,
+        .pull_phyerr = ath10k_wmi_op_pull_phyerr_ev,
+        .pull_rdy = ath10k_wmi_op_pull_rdy_ev,
+
+        .gen_pdev_suspend = ath10k_wmi_op_gen_pdev_suspend,
+        .gen_pdev_resume = ath10k_wmi_op_gen_pdev_resume,
+        .gen_pdev_set_param = ath10k_wmi_op_gen_pdev_set_param,
+        .gen_stop_scan = ath10k_wmi_op_gen_stop_scan,
+        .gen_vdev_create = ath10k_wmi_op_gen_vdev_create,
+        .gen_vdev_delete = ath10k_wmi_op_gen_vdev_delete,
+        .gen_vdev_start = ath10k_wmi_op_gen_vdev_start,
+        .gen_vdev_stop = ath10k_wmi_op_gen_vdev_stop,
+        .gen_vdev_up = ath10k_wmi_op_gen_vdev_up,
+        .gen_vdev_down = ath10k_wmi_op_gen_vdev_down,
+        .gen_vdev_set_param = ath10k_wmi_op_gen_vdev_set_param,
+        .gen_vdev_install_key = ath10k_wmi_op_gen_vdev_install_key,
+        .gen_vdev_spectral_conf = ath10k_wmi_op_gen_vdev_spectral_conf,
+        .gen_vdev_spectral_enable = ath10k_wmi_op_gen_vdev_spectral_enable,
+        /* .gen_vdev_wmm_conf not implemented */
+        .gen_peer_create = ath10k_wmi_op_gen_peer_create,
+        .gen_peer_delete = ath10k_wmi_op_gen_peer_delete,
+        .gen_peer_flush = ath10k_wmi_op_gen_peer_flush,
+        .gen_peer_set_param = ath10k_wmi_op_gen_peer_set_param,
+        .gen_set_psmode = ath10k_wmi_op_gen_set_psmode,
+        .gen_set_sta_ps = ath10k_wmi_op_gen_set_sta_ps,
+        .gen_set_ap_ps = ath10k_wmi_op_gen_set_ap_ps,
+        .gen_scan_chan_list = ath10k_wmi_op_gen_scan_chan_list,
+        .gen_beacon_dma = ath10k_wmi_op_gen_beacon_dma,
+        .gen_pdev_set_wmm = ath10k_wmi_op_gen_pdev_set_wmm,
+        .gen_request_stats = ath10k_wmi_op_gen_request_stats,
+        .gen_force_fw_hang = ath10k_wmi_op_gen_force_fw_hang,
+        .gen_mgmt_tx = ath10k_wmi_op_gen_mgmt_tx,
+        .gen_dbglog_cfg = ath10k_wmi_op_gen_dbglog_cfg,
+        .gen_pktlog_enable = ath10k_wmi_op_gen_pktlog_enable,
+        .gen_pktlog_disable = ath10k_wmi_op_gen_pktlog_disable,
+        .gen_pdev_set_quiet_mode = ath10k_wmi_op_gen_pdev_set_quiet_mode,
+        .gen_addba_clear_resp = ath10k_wmi_op_gen_addba_clear_resp,
+        .gen_addba_send = ath10k_wmi_op_gen_addba_send,
+        .gen_addba_set_resp = ath10k_wmi_op_gen_addba_set_resp,
+        .gen_delba_send = ath10k_wmi_op_gen_delba_send,
+        /* .gen_bcn_tmpl not implemented */
+        /* .gen_prb_tmpl not implemented */
+        /* .gen_p2p_go_bcn_ie not implemented */
+};
+
+static const struct wmi_ops wmi_10_2_ops = {
+        .rx = ath10k_wmi_10_2_op_rx,
+        .pull_fw_stats = ath10k_wmi_10_2_op_pull_fw_stats,
+        .gen_init = ath10k_wmi_10_2_op_gen_init,
+        .gen_peer_assoc = ath10k_wmi_10_2_op_gen_peer_assoc,
+        /* .gen_pdev_get_temperature not implemented */
+
+        /* shared with 10.1 */
+        .map_svc = wmi_10x_svc_map,
+        .pull_svc_rdy = ath10k_wmi_10x_op_pull_svc_rdy_ev,
+        .gen_pdev_set_rd = ath10k_wmi_10x_op_gen_pdev_set_rd,
+        .gen_start_scan = ath10k_wmi_10x_op_gen_start_scan,
+
+        .pull_scan = ath10k_wmi_op_pull_scan_ev,
+        .pull_mgmt_rx = ath10k_wmi_op_pull_mgmt_rx_ev,
+        .pull_ch_info = ath10k_wmi_op_pull_ch_info_ev,
+        .pull_vdev_start = ath10k_wmi_op_pull_vdev_start_ev,
+        .pull_peer_kick = ath10k_wmi_op_pull_peer_kick_ev,
+        .pull_swba = ath10k_wmi_op_pull_swba_ev,
+        .pull_phyerr = ath10k_wmi_op_pull_phyerr_ev,
+        .pull_rdy = ath10k_wmi_op_pull_rdy_ev,
+
+        .gen_pdev_suspend = ath10k_wmi_op_gen_pdev_suspend,
+        .gen_pdev_resume = ath10k_wmi_op_gen_pdev_resume,
+        .gen_pdev_set_param = ath10k_wmi_op_gen_pdev_set_param,
+        .gen_stop_scan = ath10k_wmi_op_gen_stop_scan,
+        .gen_vdev_create = ath10k_wmi_op_gen_vdev_create,
+        .gen_vdev_delete = ath10k_wmi_op_gen_vdev_delete,
+        .gen_vdev_start = ath10k_wmi_op_gen_vdev_start,
+        .gen_vdev_stop = ath10k_wmi_op_gen_vdev_stop,
+        .gen_vdev_up = ath10k_wmi_op_gen_vdev_up,
+        .gen_vdev_down = ath10k_wmi_op_gen_vdev_down,
+        .gen_vdev_set_param = ath10k_wmi_op_gen_vdev_set_param,
+        .gen_vdev_install_key = ath10k_wmi_op_gen_vdev_install_key,
+        .gen_vdev_spectral_conf = ath10k_wmi_op_gen_vdev_spectral_conf,
+        .gen_vdev_spectral_enable = ath10k_wmi_op_gen_vdev_spectral_enable,
+        /* .gen_vdev_wmm_conf not implemented */
+        .gen_peer_create = ath10k_wmi_op_gen_peer_create,
+        .gen_peer_delete = ath10k_wmi_op_gen_peer_delete,
+        .gen_peer_flush = ath10k_wmi_op_gen_peer_flush,
+        .gen_peer_set_param = ath10k_wmi_op_gen_peer_set_param,
+        .gen_set_psmode = ath10k_wmi_op_gen_set_psmode,
+        .gen_set_sta_ps = ath10k_wmi_op_gen_set_sta_ps,
+        .gen_set_ap_ps = ath10k_wmi_op_gen_set_ap_ps,
+        .gen_scan_chan_list = ath10k_wmi_op_gen_scan_chan_list,
+        .gen_beacon_dma = ath10k_wmi_op_gen_beacon_dma,
+        .gen_pdev_set_wmm = ath10k_wmi_op_gen_pdev_set_wmm,
+        .gen_request_stats = ath10k_wmi_op_gen_request_stats,
+        .gen_force_fw_hang = ath10k_wmi_op_gen_force_fw_hang,
+        .gen_mgmt_tx = ath10k_wmi_op_gen_mgmt_tx,
+        .gen_dbglog_cfg = ath10k_wmi_op_gen_dbglog_cfg,
+        .gen_pktlog_enable = ath10k_wmi_op_gen_pktlog_enable,
+        .gen_pktlog_disable = ath10k_wmi_op_gen_pktlog_disable,
+        .gen_pdev_set_quiet_mode = ath10k_wmi_op_gen_pdev_set_quiet_mode,
+        .gen_addba_clear_resp = ath10k_wmi_op_gen_addba_clear_resp,
+        .gen_addba_send = ath10k_wmi_op_gen_addba_send,
+        .gen_addba_set_resp = ath10k_wmi_op_gen_addba_set_resp,
+        .gen_delba_send = ath10k_wmi_op_gen_delba_send,
+};
 
+static const struct wmi_ops wmi_10_2_4_ops = {
+        .rx = ath10k_wmi_10_2_op_rx,
+        .pull_fw_stats = ath10k_wmi_10_2_4_op_pull_fw_stats,
+        .gen_init = ath10k_wmi_10_2_op_gen_init,
+        .gen_peer_assoc = ath10k_wmi_10_2_op_gen_peer_assoc,
+        .gen_pdev_get_temperature = ath10k_wmi_10_2_op_gen_pdev_get_temperature,
+
+        /* shared with 10.1 */
+        .map_svc = wmi_10x_svc_map,
+        .pull_svc_rdy = ath10k_wmi_10x_op_pull_svc_rdy_ev,
+        .gen_pdev_set_rd = ath10k_wmi_10x_op_gen_pdev_set_rd,
+        .gen_start_scan = ath10k_wmi_10x_op_gen_start_scan,
+
+        .pull_scan = ath10k_wmi_op_pull_scan_ev,
+        .pull_mgmt_rx = ath10k_wmi_op_pull_mgmt_rx_ev,
+        .pull_ch_info = ath10k_wmi_op_pull_ch_info_ev,
+        .pull_vdev_start = ath10k_wmi_op_pull_vdev_start_ev,
+        .pull_peer_kick = ath10k_wmi_op_pull_peer_kick_ev,
+        .pull_swba = ath10k_wmi_op_pull_swba_ev,
+        .pull_phyerr = ath10k_wmi_op_pull_phyerr_ev,
+        .pull_rdy = ath10k_wmi_op_pull_rdy_ev,
+
+        .gen_pdev_suspend = ath10k_wmi_op_gen_pdev_suspend,
+        .gen_pdev_resume = ath10k_wmi_op_gen_pdev_resume,
+        .gen_pdev_set_param = ath10k_wmi_op_gen_pdev_set_param,
+        .gen_stop_scan = ath10k_wmi_op_gen_stop_scan,
+        .gen_vdev_create = ath10k_wmi_op_gen_vdev_create,
+        .gen_vdev_delete = ath10k_wmi_op_gen_vdev_delete,
+        .gen_vdev_start = ath10k_wmi_op_gen_vdev_start,
+        .gen_vdev_stop = ath10k_wmi_op_gen_vdev_stop,
+        .gen_vdev_up = ath10k_wmi_op_gen_vdev_up,
+        .gen_vdev_down = ath10k_wmi_op_gen_vdev_down,
+        .gen_vdev_set_param = ath10k_wmi_op_gen_vdev_set_param,
+        .gen_vdev_install_key = ath10k_wmi_op_gen_vdev_install_key,
+        .gen_vdev_spectral_conf = ath10k_wmi_op_gen_vdev_spectral_conf,
+        .gen_vdev_spectral_enable = ath10k_wmi_op_gen_vdev_spectral_enable,
+        .gen_peer_create = ath10k_wmi_op_gen_peer_create,
+        .gen_peer_delete = ath10k_wmi_op_gen_peer_delete,
+        .gen_peer_flush = ath10k_wmi_op_gen_peer_flush,
+        .gen_peer_set_param = ath10k_wmi_op_gen_peer_set_param,
+        .gen_set_psmode = ath10k_wmi_op_gen_set_psmode,
+        .gen_set_sta_ps = ath10k_wmi_op_gen_set_sta_ps,
+        .gen_set_ap_ps = ath10k_wmi_op_gen_set_ap_ps,
+        .gen_scan_chan_list = ath10k_wmi_op_gen_scan_chan_list,
+        .gen_beacon_dma = ath10k_wmi_op_gen_beacon_dma,
+        .gen_pdev_set_wmm = ath10k_wmi_op_gen_pdev_set_wmm,
+        .gen_request_stats = ath10k_wmi_op_gen_request_stats,
+        .gen_force_fw_hang = ath10k_wmi_op_gen_force_fw_hang,
+        .gen_mgmt_tx = ath10k_wmi_op_gen_mgmt_tx,
+        .gen_dbglog_cfg = ath10k_wmi_op_gen_dbglog_cfg,
+        .gen_pktlog_enable = ath10k_wmi_op_gen_pktlog_enable,
+        .gen_pktlog_disable = ath10k_wmi_op_gen_pktlog_disable,
+        .gen_pdev_set_quiet_mode = ath10k_wmi_op_gen_pdev_set_quiet_mode,
+        .gen_addba_clear_resp = ath10k_wmi_op_gen_addba_clear_resp,
+        .gen_addba_send = ath10k_wmi_op_gen_addba_send,
+        .gen_addba_set_resp = ath10k_wmi_op_gen_addba_set_resp,
+        .gen_delba_send = ath10k_wmi_op_gen_delba_send,
+        /* .gen_bcn_tmpl not implemented */
+        /* .gen_prb_tmpl not implemented */
+        /* .gen_p2p_go_bcn_ie not implemented */
+};
+
+int ath10k_wmi_attach(struct ath10k *ar)
+{
+        switch (ar->wmi.op_version) {
+        case ATH10K_FW_WMI_OP_VERSION_10_2_4:
+                ar->wmi.cmd = &wmi_10_2_4_cmd_map;
+                ar->wmi.ops = &wmi_10_2_4_ops;
+                ar->wmi.vdev_param = &wmi_10_2_4_vdev_param_map;
+                ar->wmi.pdev_param = &wmi_10_2_4_pdev_param_map;
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_10_2:
+                ar->wmi.cmd = &wmi_10_2_cmd_map;
+                ar->wmi.ops = &wmi_10_2_ops;
                 ar->wmi.vdev_param = &wmi_10x_vdev_param_map;
                 ar->wmi.pdev_param = &wmi_10x_pdev_param_map;
-        } else {
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_10_1:
+                ar->wmi.cmd = &wmi_10x_cmd_map;
+                ar->wmi.ops = &wmi_10_1_ops;
+                ar->wmi.vdev_param = &wmi_10x_vdev_param_map;
+                ar->wmi.pdev_param = &wmi_10x_pdev_param_map;
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_MAIN:
                 ar->wmi.cmd = &wmi_cmd_map;
+                ar->wmi.ops = &wmi_ops;
                 ar->wmi.vdev_param = &wmi_vdev_param_map;
                 ar->wmi.pdev_param = &wmi_pdev_param_map;
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_TLV:
+                ath10k_wmi_tlv_attach(ar);
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_UNSET:
+        case ATH10K_FW_WMI_OP_VERSION_MAX:
+                ath10k_err(ar, "unsupported WMI op version: %d\n",
+                           ar->wmi.op_version);
+                return -EINVAL;
         }
 
         init_completion(&ar->wmi.service_ready);
diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h
index 21391929d318..20ce3603e64b 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.h
+++ b/drivers/net/wireless/ath/ath10k/wmi.h
@@ -109,6 +109,45 @@ enum wmi_service {
         WMI_SERVICE_BURST,
         WMI_SERVICE_SMART_ANTENNA_SW_SUPPORT,
         WMI_SERVICE_SMART_ANTENNA_HW_SUPPORT,
+        WMI_SERVICE_ROAM_SCAN_OFFLOAD,
+        WMI_SERVICE_AP_PS_DETECT_OUT_OF_SYNC,
+        WMI_SERVICE_EARLY_RX,
+        WMI_SERVICE_STA_SMPS,
+        WMI_SERVICE_FWTEST,
+        WMI_SERVICE_STA_WMMAC,
+        WMI_SERVICE_TDLS,
+        WMI_SERVICE_MCC_BCN_INTERVAL_CHANGE,
+        WMI_SERVICE_ADAPTIVE_OCS,
+        WMI_SERVICE_BA_SSN_SUPPORT,
+        WMI_SERVICE_FILTER_IPSEC_NATKEEPALIVE,
+        WMI_SERVICE_WLAN_HB,
+        WMI_SERVICE_LTE_ANT_SHARE_SUPPORT,
+        WMI_SERVICE_BATCH_SCAN,
+        WMI_SERVICE_QPOWER,
+        WMI_SERVICE_PLMREQ,
+        WMI_SERVICE_THERMAL_MGMT,
+        WMI_SERVICE_RMC,
+        WMI_SERVICE_MHF_OFFLOAD,
+        WMI_SERVICE_COEX_SAR,
+        WMI_SERVICE_BCN_TXRATE_OVERRIDE,
+        WMI_SERVICE_NAN,
+        WMI_SERVICE_L1SS_STAT,
+        WMI_SERVICE_ESTIMATE_LINKSPEED,
+        WMI_SERVICE_OBSS_SCAN,
+        WMI_SERVICE_TDLS_OFFCHAN,
+        WMI_SERVICE_TDLS_UAPSD_BUFFER_STA,
+        WMI_SERVICE_TDLS_UAPSD_SLEEP_STA,
+        WMI_SERVICE_IBSS_PWRSAVE,
+        WMI_SERVICE_LPASS,
+        WMI_SERVICE_EXTSCAN,
+        WMI_SERVICE_D0WOW,
+        WMI_SERVICE_HSOFFLOAD,
+        WMI_SERVICE_ROAM_HO_OFFLOAD,
+        WMI_SERVICE_RX_FULL_REORDER,
+        WMI_SERVICE_DHCP_OFFLOAD,
+        WMI_SERVICE_STA_RX_IPA_OFFLOAD_SUPPORT,
+        WMI_SERVICE_MDNS_OFFLOAD,
+        WMI_SERVICE_SAP_AUTH_OFFLOAD,
 
         /* keep last */
         WMI_SERVICE_MAX,
@@ -215,6 +254,45 @@ static inline char *wmi_service_name(int service_id)
         SVCSTR(WMI_SERVICE_BURST);
         SVCSTR(WMI_SERVICE_SMART_ANTENNA_SW_SUPPORT);
         SVCSTR(WMI_SERVICE_SMART_ANTENNA_HW_SUPPORT);
+        SVCSTR(WMI_SERVICE_ROAM_SCAN_OFFLOAD);
+        SVCSTR(WMI_SERVICE_AP_PS_DETECT_OUT_OF_SYNC);
+        SVCSTR(WMI_SERVICE_EARLY_RX);
+        SVCSTR(WMI_SERVICE_STA_SMPS);
+        SVCSTR(WMI_SERVICE_FWTEST);
+        SVCSTR(WMI_SERVICE_STA_WMMAC);
+        SVCSTR(WMI_SERVICE_TDLS);
+        SVCSTR(WMI_SERVICE_MCC_BCN_INTERVAL_CHANGE);
+        SVCSTR(WMI_SERVICE_ADAPTIVE_OCS);
+        SVCSTR(WMI_SERVICE_BA_SSN_SUPPORT);
+        SVCSTR(WMI_SERVICE_FILTER_IPSEC_NATKEEPALIVE);
+        SVCSTR(WMI_SERVICE_WLAN_HB);
+        SVCSTR(WMI_SERVICE_LTE_ANT_SHARE_SUPPORT);
+        SVCSTR(WMI_SERVICE_BATCH_SCAN);
+        SVCSTR(WMI_SERVICE_QPOWER);
+        SVCSTR(WMI_SERVICE_PLMREQ);
+        SVCSTR(WMI_SERVICE_THERMAL_MGMT);
+        SVCSTR(WMI_SERVICE_RMC);
+        SVCSTR(WMI_SERVICE_MHF_OFFLOAD);
+        SVCSTR(WMI_SERVICE_COEX_SAR);
+        SVCSTR(WMI_SERVICE_BCN_TXRATE_OVERRIDE);
+        SVCSTR(WMI_SERVICE_NAN);
+        SVCSTR(WMI_SERVICE_L1SS_STAT);
+        SVCSTR(WMI_SERVICE_ESTIMATE_LINKSPEED);
+        SVCSTR(WMI_SERVICE_OBSS_SCAN);
+        SVCSTR(WMI_SERVICE_TDLS_OFFCHAN);
+        SVCSTR(WMI_SERVICE_TDLS_UAPSD_BUFFER_STA);
+        SVCSTR(WMI_SERVICE_TDLS_UAPSD_SLEEP_STA);
+        SVCSTR(WMI_SERVICE_IBSS_PWRSAVE);
+        SVCSTR(WMI_SERVICE_LPASS);
+        SVCSTR(WMI_SERVICE_EXTSCAN);
+        SVCSTR(WMI_SERVICE_D0WOW);
+        SVCSTR(WMI_SERVICE_HSOFFLOAD);
+        SVCSTR(WMI_SERVICE_ROAM_HO_OFFLOAD);
+        SVCSTR(WMI_SERVICE_RX_FULL_REORDER);
+        SVCSTR(WMI_SERVICE_DHCP_OFFLOAD);
+        SVCSTR(WMI_SERVICE_STA_RX_IPA_OFFLOAD_SUPPORT);
+        SVCSTR(WMI_SERVICE_MDNS_OFFLOAD);
+        SVCSTR(WMI_SERVICE_SAP_AUTH_OFFLOAD);
         default:
                 return NULL;
         }
@@ -472,6 +550,8 @@ struct wmi_cmd_map {
         u32 force_fw_hang_cmdid;
         u32 gpio_config_cmdid;
         u32 gpio_output_cmdid;
+        u32 pdev_get_temperature_cmdid;
+        u32 vdev_set_wmm_params_cmdid;
 };
 
 /*
@@ -1076,6 +1156,11 @@ enum wmi_10_2_cmd_id {
         WMI_10_2_PDEV_SET_MIMOGAIN_TABLE_CMDID,
         WMI_10_2_PDEV_RATEPWR_TABLE_CMDID,
         WMI_10_2_PDEV_RATEPWR_CHAINMSK_TABLE_CMDID,
+        WMI_10_2_PDEV_GET_INFO,
+        WMI_10_2_VDEV_GET_INFO,
+        WMI_10_2_VDEV_ATF_REQUEST_CMDID,
+        WMI_10_2_PEER_ATF_REQUEST_CMDID,
+        WMI_10_2_PDEV_GET_TEMPERATURE_CMDID,
         WMI_10_2_PDEV_UTF_CMDID = WMI_10_2_END_CMDID - 1,
 };
 
@@ -1117,6 +1202,8 @@ enum wmi_10_2_event_id {
         WMI_10_2_MCAST_BUF_RELEASE_EVENTID,
         WMI_10_2_MCAST_LIST_AGEOUT_EVENTID,
         WMI_10_2_WDS_PEER_EVENTID,
+        WMI_10_2_PEER_STA_PS_STATECHG_EVENTID,
+        WMI_10_2_PDEV_TEMPERATURE_EVENTID,
         WMI_10_2_PDEV_UTF_EVENTID = WMI_10_2_END_EVENTID - 1,
 };
 
@@ -1862,6 +1949,11 @@ struct wmi_resource_config_10x {
         __le32 max_frag_entries;
 } __packed;
 
+enum wmi_10_2_feature_mask {
+        WMI_10_2_RX_BATCH_MODE = BIT(0),
+        WMI_10_2_ATF_CONFIG    = BIT(1),
+};
+
 struct wmi_resource_config_10_2 {
         struct wmi_resource_config_10x common;
         __le32 max_peer_ext_stats;
@@ -1870,7 +1962,7 @@ struct wmi_resource_config_10_2 {
         __le32 be_min_free;
         __le32 vi_min_free;
         __le32 vo_min_free;
-        __le32 rx_batchmode; /* 0-disable, 1-enable */
+        __le32 feature_mask;
 } __packed;
 
 #define NUM_UNITS_IS_NUM_VDEVS   0x1
@@ -2505,6 +2597,7 @@ struct wmi_pdev_param_map {
         u32 fast_channel_reset;
         u32 burst_dur;
         u32 burst_enable;
+        u32 cal_period;
 };
 
 #define WMI_PDEV_PARAM_UNSUPPORTED 0
@@ -2715,6 +2808,9 @@ enum wmi_10x_pdev_param {
         WMI_10X_PDEV_PARAM_SET_MCAST2UCAST_MODE,
         WMI_10X_PDEV_PARAM_SET_MCAST2UCAST_BUFFER,
         WMI_10X_PDEV_PARAM_REMOVE_MCAST2UCAST_BUFFER,
+        WMI_10X_PDEV_PARAM_PEER_STA_PS_STATECHG_ENABLE,
+        WMI_10X_PDEV_PARAM_RTS_FIXED_RATE,
+        WMI_10X_PDEV_PARAM_CAL_PERIOD
 };
 
 struct wmi_pdev_set_param_cmd {
@@ -2722,6 +2818,9 @@ struct wmi_pdev_set_param_cmd {
         __le32 param_value;
 } __packed;
 
+/* valid period is 1 ~ 60000ms, unit in millisecond */
+#define WMI_PDEV_PARAM_CAL_PERIOD_MAX 60000
+
 struct wmi_pdev_get_tpc_config_cmd {
         /* parameter   */
         __le32 param;
@@ -2841,14 +2940,14 @@ struct wmi_wmm_params_arg {
         u32 no_ack;
 };
 
-struct wmi_pdev_set_wmm_params_arg {
+struct wmi_wmm_params_all_arg {
         struct wmi_wmm_params_arg ac_be;
         struct wmi_wmm_params_arg ac_bk;
         struct wmi_wmm_params_arg ac_vi;
         struct wmi_wmm_params_arg ac_vo;
 };
 
-struct wal_dbg_tx_stats {
+struct wmi_pdev_stats_tx {
         /* Num HTT cookies queued to dispatch list */
         __le32 comp_queued;
 
@@ -2918,7 +3017,7 @@ struct wal_dbg_tx_stats {
         __le32 txop_ovf;
 } __packed;
 
-struct wal_dbg_rx_stats {
+struct wmi_pdev_stats_rx {
         /* Cnts any change in ring routing mid-ppdu */
         __le32 mid_ppdu_route_change;
 
@@ -2952,17 +3051,11 @@ struct wal_dbg_rx_stats {
         __le32 mpdu_errs;
 } __packed;
 
-struct wal_dbg_peer_stats {
+struct wmi_pdev_stats_peer {
         /* REMOVE THIS ONCE REAL PEER STAT COUNTERS ARE ADDED */
         __le32 dummy;
 } __packed;
 
-struct wal_dbg_stats {
-        struct wal_dbg_tx_stats tx;
-        struct wal_dbg_rx_stats rx;
-        struct wal_dbg_peer_stats peer;
-} __packed;
-
 enum wmi_stats_id {
         WMI_REQUEST_PEER_STAT   = 0x01,
         WMI_REQUEST_AP_STAT     = 0x02
@@ -3029,23 +3122,38 @@ struct wmi_stats_event {
         u8 data[0];
 } __packed;
 
+struct wmi_10_2_stats_event {
+        __le32 stats_id; /* %WMI_REQUEST_ */
+        __le32 num_pdev_stats;
+        __le32 num_pdev_ext_stats;
+        __le32 num_vdev_stats;
+        __le32 num_peer_stats;
+        __le32 num_bcnflt_stats;
+        u8 data[0];
+} __packed;
+
 /*
  * PDEV statistics
  * TODO: add all PDEV stats here
  */
+struct wmi_pdev_stats_base {
+        __le32 chan_nf;
+        __le32 tx_frame_count;
+        __le32 rx_frame_count;
+        __le32 rx_clear_count;
+        __le32 cycle_count;
+        __le32 phy_err_count;
+        __le32 chan_tx_pwr;
+} __packed;
+
 struct wmi_pdev_stats {
-        __le32 chan_nf;        /* Channel noise floor */
-        __le32 tx_frame_count; /* TX frame count */
-        __le32 rx_frame_count; /* RX frame count */
-        __le32 rx_clear_count; /* rx clear count */
-        __le32 cycle_count;    /* cycle count */
-        __le32 phy_err_count;  /* Phy error count */
-        __le32 chan_tx_pwr;    /* channel tx power */
-        struct wal_dbg_stats wal; /* WAL dbg stats */
+        struct wmi_pdev_stats_base base;
+        struct wmi_pdev_stats_tx tx;
+        struct wmi_pdev_stats_rx rx;
+        struct wmi_pdev_stats_peer peer;
 } __packed;
 
-struct wmi_10x_pdev_stats {
-        struct wmi_pdev_stats old;
+struct wmi_pdev_stats_extra {
         __le32 ack_rx_bad;
         __le32 rts_bad;
         __le32 rts_good;
@@ -3054,6 +3162,30 @@ struct wmi_10x_pdev_stats {
         __le32 mib_int_count;
 } __packed;
 
+struct wmi_10x_pdev_stats {
+        struct wmi_pdev_stats_base base;
+        struct wmi_pdev_stats_tx tx;
+        struct wmi_pdev_stats_rx rx;
+        struct wmi_pdev_stats_peer peer;
+        struct wmi_pdev_stats_extra extra;
+} __packed;
+
+struct wmi_pdev_stats_mem {
+        __le32 dram_free;
+        __le32 iram_free;
+} __packed;
+
+struct wmi_10_2_pdev_stats {
+        struct wmi_pdev_stats_base base;
+        struct wmi_pdev_stats_tx tx;
+        __le32 mc_drop;
+        struct wmi_pdev_stats_rx rx;
+        __le32 pdev_rx_timeout;
+        struct wmi_pdev_stats_mem mem;
+        struct wmi_pdev_stats_peer peer;
+        struct wmi_pdev_stats_extra extra;
+} __packed;
+
 /*
  * VDEV statistics
  * TODO: add all VDEV stats here
@@ -3077,6 +3209,32 @@ struct wmi_10x_peer_stats {
         __le32 peer_rx_rate;
 } __packed;
 
+struct wmi_10_2_peer_stats {
+        struct wmi_peer_stats old;
+        __le32 peer_rx_rate;
+        __le32 current_per;
+        __le32 retries;
+        __le32 tx_rate_count;
+        __le32 max_4ms_frame_len;
+        __le32 total_sub_frames;
+        __le32 tx_bytes;
+        __le32 num_pkt_loss_overflow[4];
+        __le32 num_pkt_loss_excess_retry[4];
+} __packed;
+
+struct wmi_10_2_4_peer_stats {
+        struct wmi_10_2_peer_stats common;
+        __le32 unknown_value; /* FIXME: what is this word? */
+} __packed;
+
+struct wmi_10_2_pdev_ext_stats {
+        __le32 rx_rssi_comb;
+        __le32 rx_rssi[4];
+        __le32 rx_mcs[10];
+        __le32 tx_mcs[10];
+        __le32 ack_rssi;
+} __packed;
+
 struct wmi_vdev_create_cmd {
         __le32 vdev_id;
         __le32 vdev_type;
@@ -3930,6 +4088,13 @@ enum wmi_sta_ps_param_pspoll_count {
          * Values greater than 0 indicate the maximum numer of PS-Poll frames
          * FW will send before waking up.
          */
+
+        /* When u-APSD is enabled the firmware will be very reluctant to exit
+         * STA PS. This could result in very poor Rx performance with STA doing
+         * PS-Poll for each and every buffered frame. This value is a bit
+         * arbitrary.
+         */
+        WMI_STA_PS_PSPOLL_COUNT_UAPSD = 3,
 };
 
 /*
@@ -3955,6 +4120,30 @@ enum wmi_sta_ps_param_uapsd {
         WMI_STA_PS_UAPSD_AC3_TRIGGER_EN  = (1 << 7),
 };
 
+#define WMI_STA_UAPSD_MAX_INTERVAL_MSEC UINT_MAX
+
+struct wmi_sta_uapsd_auto_trig_param {
+        __le32 wmm_ac;
+        __le32 user_priority;
+        __le32 service_interval;
+        __le32 suspend_interval;
+        __le32 delay_interval;
+};
+
+struct wmi_sta_uapsd_auto_trig_cmd_fixed_param {
+        __le32 vdev_id;
+        struct wmi_mac_addr peer_macaddr;
+        __le32 num_ac;
+};
+
+struct wmi_sta_uapsd_auto_trig_arg {
+        u32 wmm_ac;
+        u32 user_priority;
+        u32 service_interval;
+        u32 suspend_interval;
+        u32 delay_interval;
+};
+
 enum wmi_sta_powersave_param {
         /*
          * Controls how frames are retrievd from AP while STA is sleeping
@@ -4120,7 +4309,7 @@ struct wmi_bcn_info {
 
 struct wmi_host_swba_event {
         __le32 vdev_map;
-        struct wmi_bcn_info bcn_info[1];
+        struct wmi_bcn_info bcn_info[0];
 } __packed;
 
 #define WMI_MAX_AP_VDEV 16
@@ -4325,7 +4514,7 @@ struct wmi_peer_set_q_empty_callback_cmd {
 #define WMI_PEER_SPATIAL_MUX    0x00200000
 #define WMI_PEER_VHT            0x02000000
 #define WMI_PEER_80MHZ          0x04000000
-#define WMI_PEER_PMF            0x08000000
+#define WMI_PEER_VHT_2G         0x08000000
 
 /*
  * Peer rate capabilities.
@@ -4476,6 +4665,11 @@ enum wmi_sta_keepalive_method {
         WMI_STA_KEEPALIVE_METHOD_UNSOLICITATED_ARP_RESPONSE = 2,
 };
 
+#define WMI_STA_KEEPALIVE_INTERVAL_DISABLE 0
+
+/* Firmware crashes if keepalive interval exceeds this limit */
+#define WMI_STA_KEEPALIVE_INTERVAL_MAX_SECONDS 0xffff
+
 /* note: ip4 addresses are in network byte order, i.e. big endian */
 struct wmi_sta_keepalive_arp_resp {
         __be32 src_ip4_addr;
@@ -4491,6 +4685,16 @@ struct wmi_sta_keepalive_cmd {
         struct wmi_sta_keepalive_arp_resp arp_resp;
 } __packed;
 
+struct wmi_sta_keepalive_arg {
+        u32 vdev_id;
+        u32 enabled;
+        u32 method;
+        u32 interval;
+        __be32 src_ip4_addr;
+        __be32 dest_ip4_addr;
+        const u8 dest_mac_addr[ETH_ALEN];
+};
+
 enum wmi_force_fw_hang_type {
         WMI_FORCE_FW_HANG_ASSERT = 1,
         WMI_FORCE_FW_HANG_NO_DETECT,
@@ -4567,6 +4771,58 @@ struct wmi_dbglog_cfg_cmd {
 
 #define WMI_MAX_MEM_REQS 16
 
+struct wmi_scan_ev_arg {
+        __le32 event_type; /* %WMI_SCAN_EVENT_ */
+        __le32 reason; /* %WMI_SCAN_REASON_ */
+        __le32 channel_freq; /* only valid for WMI_SCAN_EVENT_FOREIGN_CHANNEL */
+        __le32 scan_req_id;
+        __le32 scan_id;
+        __le32 vdev_id;
+};
+
+struct wmi_mgmt_rx_ev_arg {
+        __le32 channel;
+        __le32 snr;
+        __le32 rate;
+        __le32 phy_mode;
+        __le32 buf_len;
+        __le32 status; /* %WMI_RX_STATUS_ */
+};
+
+struct wmi_ch_info_ev_arg {
+        __le32 err_code;
+        __le32 freq;
+        __le32 cmd_flags;
+        __le32 noise_floor;
+        __le32 rx_clear_count;
+        __le32 cycle_count;
+};
+
+struct wmi_vdev_start_ev_arg {
+        __le32 vdev_id;
+        __le32 req_id;
+        __le32 resp_type; /* %WMI_VDEV_RESP_ */
+        __le32 status;
+};
+
+struct wmi_peer_kick_ev_arg {
+        const u8 *mac_addr;
+};
+
+struct wmi_swba_ev_arg {
+        __le32 vdev_map;
+        const struct wmi_tim_info *tim_info[WMI_MAX_AP_VDEV];
+        const struct wmi_p2p_noa_info *noa_info[WMI_MAX_AP_VDEV];
+};
+
+struct wmi_phyerr_ev_arg {
+        __le32 num_phyerrs;
+        __le32 tsf_l32;
+        __le32 tsf_u32;
+        __le32 buf_len;
+        const struct wmi_phyerr *phyerrs;
+};
+
 struct wmi_svc_rdy_ev_arg {
         __le32 min_tx_power;
         __le32 max_tx_power;
@@ -4574,6 +4830,7 @@ struct wmi_svc_rdy_ev_arg {
         __le32 vht_cap;
         __le32 sw_ver0;
         __le32 sw_ver1;
+        __le32 fw_build;
         __le32 phy_capab;
         __le32 num_rf_chains;
         __le32 eeprom_rd;
@@ -4583,83 +4840,99 @@ struct wmi_svc_rdy_ev_arg {
         const struct wlan_host_mem_req *mem_reqs[WMI_MAX_MEM_REQS];
 };
 
+struct wmi_rdy_ev_arg {
+        __le32 sw_version;
+        __le32 abi_version;
+        __le32 status;
+        const u8 *mac_addr;
+};
+
+struct wmi_pdev_temperature_event {
+        /* temperature value in Celcius degree */
+        __le32 temperature;
+} __packed;
+
 struct ath10k;
 struct ath10k_vif;
-struct ath10k_fw_stats;
+struct ath10k_fw_stats_pdev;
+struct ath10k_fw_stats_peer;
 
 int ath10k_wmi_attach(struct ath10k *ar);
 void ath10k_wmi_detach(struct ath10k *ar);
 int ath10k_wmi_wait_for_service_ready(struct ath10k *ar);
 int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar);
 
+struct sk_buff *ath10k_wmi_alloc_skb(struct ath10k *ar, u32 len);
 int ath10k_wmi_connect(struct ath10k *ar);
 
 struct sk_buff *ath10k_wmi_alloc_skb(struct ath10k *ar, u32 len);
 int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id);
-
-int ath10k_wmi_pdev_suspend_target(struct ath10k *ar, u32 suspend_opt);
-int ath10k_wmi_pdev_resume_target(struct ath10k *ar);
-int ath10k_wmi_pdev_set_regdomain(struct ath10k *ar, u16 rd, u16 rd2g,
-                                  u16 rd5g, u16 ctl2g, u16 ctl5g,
-                                  enum wmi_dfs_region dfs_reg);
-int ath10k_wmi_pdev_set_param(struct ath10k *ar, u32 id, u32 value);
-int ath10k_wmi_cmd_init(struct ath10k *ar);
-int ath10k_wmi_start_scan(struct ath10k *ar, const struct wmi_start_scan_arg *);
+int ath10k_wmi_cmd_send_nowait(struct ath10k *ar, struct sk_buff *skb,
+                               u32 cmd_id);
 void ath10k_wmi_start_scan_init(struct ath10k *ar, struct wmi_start_scan_arg *);
-int ath10k_wmi_stop_scan(struct ath10k *ar,
-                         const struct wmi_stop_scan_arg *arg);
-int ath10k_wmi_vdev_create(struct ath10k *ar, u32 vdev_id,
-                           enum wmi_vdev_type type,
-                           enum wmi_vdev_subtype subtype,
-                           const u8 macaddr[ETH_ALEN]);
-int ath10k_wmi_vdev_delete(struct ath10k *ar, u32 vdev_id);
-int ath10k_wmi_vdev_start(struct ath10k *ar,
-                          const struct wmi_vdev_start_request_arg *);
-int ath10k_wmi_vdev_restart(struct ath10k *ar,
-                            const struct wmi_vdev_start_request_arg *);
-int ath10k_wmi_vdev_stop(struct ath10k *ar, u32 vdev_id);
-int ath10k_wmi_vdev_up(struct ath10k *ar, u32 vdev_id, u32 aid,
-                       const u8 *bssid);
-int ath10k_wmi_vdev_down(struct ath10k *ar, u32 vdev_id);
-int ath10k_wmi_vdev_set_param(struct ath10k *ar, u32 vdev_id,
-                              u32 param_id, u32 param_value);
-int ath10k_wmi_vdev_install_key(struct ath10k *ar,
-                                const struct wmi_vdev_install_key_arg *arg);
-int ath10k_wmi_vdev_spectral_conf(struct ath10k *ar,
-                                  const struct wmi_vdev_spectral_conf_arg *arg);
-int ath10k_wmi_vdev_spectral_enable(struct ath10k *ar, u32 vdev_id, u32 trigger,
-                                    u32 enable);
-int ath10k_wmi_peer_create(struct ath10k *ar, u32 vdev_id,
-                           const u8 peer_addr[ETH_ALEN]);
-int ath10k_wmi_peer_delete(struct ath10k *ar, u32 vdev_id,
-                           const u8 peer_addr[ETH_ALEN]);
-int ath10k_wmi_peer_flush(struct ath10k *ar, u32 vdev_id,
-                          const u8 peer_addr[ETH_ALEN], u32 tid_bitmap);
-int ath10k_wmi_peer_set_param(struct ath10k *ar, u32 vdev_id,
-                              const u8 *peer_addr,
-                              enum wmi_peer_param param_id, u32 param_value);
-int ath10k_wmi_peer_assoc(struct ath10k *ar,
-                          const struct wmi_peer_assoc_complete_arg *arg);
-int ath10k_wmi_set_psmode(struct ath10k *ar, u32 vdev_id,
-                          enum wmi_sta_ps_mode psmode);
-int ath10k_wmi_set_sta_ps_param(struct ath10k *ar, u32 vdev_id,
-                                enum wmi_sta_powersave_param param_id,
-                                u32 value);
-int ath10k_wmi_set_ap_ps_param(struct ath10k *ar, u32 vdev_id, const u8 *mac,
-                               enum wmi_ap_ps_peer_param param_id, u32 value);
-int ath10k_wmi_scan_chan_list(struct ath10k *ar,
-                              const struct wmi_scan_chan_list_arg *arg);
-int ath10k_wmi_beacon_send_ref_nowait(struct ath10k_vif *arvif);
-int ath10k_wmi_pdev_set_wmm_params(struct ath10k *ar,
-                                   const struct wmi_pdev_set_wmm_params_arg *arg);
-int ath10k_wmi_request_stats(struct ath10k *ar, enum wmi_stats_id stats_id);
-int ath10k_wmi_force_fw_hang(struct ath10k *ar,
-                             enum wmi_force_fw_hang_type type, u32 delay_ms);
-int ath10k_wmi_mgmt_tx(struct ath10k *ar, struct sk_buff *skb);
-int ath10k_wmi_dbglog_cfg(struct ath10k *ar, u32 module_enable);
-int ath10k_wmi_pull_fw_stats(struct ath10k *ar, struct sk_buff *skb,
-                             struct ath10k_fw_stats *stats);
-int ath10k_wmi_pdev_pktlog_enable(struct ath10k *ar, u32 ev_list);
-int ath10k_wmi_pdev_pktlog_disable(struct ath10k *ar);
+
+void ath10k_wmi_pull_pdev_stats_base(const struct wmi_pdev_stats_base *src,
+                                     struct ath10k_fw_stats_pdev *dst);
+void ath10k_wmi_pull_pdev_stats_tx(const struct wmi_pdev_stats_tx *src,
+                                   struct ath10k_fw_stats_pdev *dst);
+void ath10k_wmi_pull_pdev_stats_rx(const struct wmi_pdev_stats_rx *src,
+                                   struct ath10k_fw_stats_pdev *dst);
+void ath10k_wmi_pull_pdev_stats_extra(const struct wmi_pdev_stats_extra *src,
+                                      struct ath10k_fw_stats_pdev *dst);
+void ath10k_wmi_pull_peer_stats(const struct wmi_peer_stats *src,
+                                struct ath10k_fw_stats_peer *dst);
+void ath10k_wmi_put_host_mem_chunks(struct ath10k *ar,
+                                    struct wmi_host_mem_chunks *chunks);
+void ath10k_wmi_put_start_scan_common(struct wmi_start_scan_common *cmn,
+                                      const struct wmi_start_scan_arg *arg);
+void ath10k_wmi_set_wmm_param(struct wmi_wmm_params *params,
+                              const struct wmi_wmm_params_arg *arg);
+void ath10k_wmi_put_wmi_channel(struct wmi_channel *ch,
+                                const struct wmi_channel_arg *arg);
+int ath10k_wmi_start_scan_verify(const struct wmi_start_scan_arg *arg);
+
+int ath10k_wmi_event_scan(struct ath10k *ar, struct sk_buff *skb);
+int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_chan_info(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_echo(struct ath10k *ar, struct sk_buff *skb);
+int ath10k_wmi_event_debug_mesg(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_update_stats(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_vdev_start_resp(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_vdev_stopped(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_peer_sta_kickout(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_tbttoffset_update(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_dfs(struct ath10k *ar,
+                          const struct wmi_phyerr *phyerr, u64 tsf);
+void ath10k_wmi_event_spectral_scan(struct ath10k *ar,
+                                    const struct wmi_phyerr *phyerr,
+                                    u64 tsf);
+void ath10k_wmi_event_phyerr(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_roam(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_profile_match(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_debug_print(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_pdev_qvit(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_wlan_profile_data(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_rtt_measurement_report(struct ath10k *ar,
+                                             struct sk_buff *skb);
+void ath10k_wmi_event_tsf_measurement_report(struct ath10k *ar,
+                                             struct sk_buff *skb);
+void ath10k_wmi_event_rtt_error_report(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_wow_wakeup_host(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_dcs_interference(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_pdev_tpc_config(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_pdev_ftm_intg(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_gtk_offload_status(struct ath10k *ar,
+                                         struct sk_buff *skb);
+void ath10k_wmi_event_gtk_rekey_fail(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_delba_complete(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_addba_complete(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_vdev_install_key_complete(struct ath10k *ar,
+                                                struct sk_buff *skb);
+void ath10k_wmi_event_inst_rssi_stats(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_vdev_standby_req(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_vdev_resume_req(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_service_ready(struct ath10k *ar, struct sk_buff *skb);
+int ath10k_wmi_event_ready(struct ath10k *ar, struct sk_buff *skb);
 
 #endif /* _WMI_H_ */
diff --git a/drivers/net/wireless/ath/ath5k/ahb.c b/drivers/net/wireless/ath/ath5k/ahb.c
index 8f387cf67340..2ca88b593e4c 100644
--- a/drivers/net/wireless/ath/ath5k/ahb.c
+++ b/drivers/net/wireless/ath/ath5k/ahb.c
@@ -227,7 +227,6 @@ static struct platform_driver ath_ahb_driver = {
         .remove     = ath_ahb_remove,
         .driver         = {
                 .name   = "ar231x-wmac",
-                .owner  = THIS_MODULE,
         },
 };
 
diff --git a/drivers/net/wireless/ath/ath5k/mac80211-ops.c b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
index 19eab2a69ad5..3b4a6463d87a 100644
--- a/drivers/net/wireless/ath/ath5k/mac80211-ops.c
+++ b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
@@ -672,10 +672,10 @@ ath5k_get_survey(struct ieee80211_hw *hw, int idx, struct survey_info *survey)
         spin_lock_bh(&common->cc_lock);
         ath_hw_cycle_counters_update(common);
         if (cc->cycles > 0) {
-                ah->survey.channel_time += cc->cycles / div;
-                ah->survey.channel_time_busy += cc->rx_busy / div;
-                ah->survey.channel_time_rx += cc->rx_frame / div;
-                ah->survey.channel_time_tx += cc->tx_frame / div;
+                ah->survey.time += cc->cycles / div;
+                ah->survey.time_busy += cc->rx_busy / div;
+                ah->survey.time_rx += cc->rx_frame / div;
+                ah->survey.time_tx += cc->tx_frame / div;
         }
         memset(cc, 0, sizeof(*cc));
         spin_unlock_bh(&common->cc_lock);
@@ -686,10 +686,10 @@ ath5k_get_survey(struct ieee80211_hw *hw, int idx, struct survey_info *survey)
         survey->noise = ah->ah_noise_floor;
         survey->filled = SURVEY_INFO_NOISE_DBM |
                         SURVEY_INFO_IN_USE |
-                        SURVEY_INFO_CHANNEL_TIME |
-                        SURVEY_INFO_CHANNEL_TIME_BUSY |
-                        SURVEY_INFO_CHANNEL_TIME_RX |
-                        SURVEY_INFO_CHANNEL_TIME_TX;
+                        SURVEY_INFO_TIME |
+                        SURVEY_INFO_TIME_BUSY |
+                        SURVEY_INFO_TIME_RX |
+                        SURVEY_INFO_TIME_TX;
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath/ath5k/pcu.c b/drivers/net/wireless/ath/ath5k/pcu.c
index c60d36aa13e2..bf29da5e90da 100644
--- a/drivers/net/wireless/ath/ath5k/pcu.c
+++ b/drivers/net/wireless/ath/ath5k/pcu.c
@@ -912,6 +912,7 @@ ath5k_hw_set_opmode(struct ath5k_hw *ah, enum nl80211_iftype op_mode)
                 pcu_reg |= AR5K_STA_ID1_KEYSRCH_MODE
                         | (ah->ah_version == AR5K_AR5210 ?
                                 AR5K_STA_ID1_PWR_SV : 0);
+                /* fall through */
         case NL80211_IFTYPE_MONITOR:
                 pcu_reg |= AR5K_STA_ID1_KEYSRCH_MODE
                         | (ah->ah_version == AR5K_AR5210 ?
diff --git a/drivers/net/wireless/ath/ath5k/reset.c b/drivers/net/wireless/ath/ath5k/reset.c
index a3399c4f13a9..b9b651ea9851 100644
--- a/drivers/net/wireless/ath/ath5k/reset.c
+++ b/drivers/net/wireless/ath/ath5k/reset.c
@@ -478,7 +478,7 @@ ath5k_hw_wisoc_reset(struct ath5k_hw *ah, u32 flags)
         regval = ioread32(reg);
         iowrite32(regval | val, reg);
         regval = ioread32(reg);
-        usleep_range(100, 150);
+        udelay(100);    /* NB: should be atomic */
 
         /* Bring BB/MAC out of reset */
         iowrite32(regval & ~val, reg);
diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
index 7a5337877a0c..85da63a67faf 100644
--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
@@ -1799,20 +1799,20 @@ static int ath6kl_get_station(struct wiphy *wiphy, struct net_device *dev,
 
         if (vif->target_stats.rx_byte) {
                 sinfo->rx_bytes = vif->target_stats.rx_byte;
-                sinfo->filled |= STATION_INFO_RX_BYTES64;
+                sinfo->filled |= BIT(NL80211_STA_INFO_RX_BYTES64);
                 sinfo->rx_packets = vif->target_stats.rx_pkt;
-                sinfo->filled |= STATION_INFO_RX_PACKETS;
+                sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS);
         }
 
         if (vif->target_stats.tx_byte) {
                 sinfo->tx_bytes = vif->target_stats.tx_byte;
-                sinfo->filled |= STATION_INFO_TX_BYTES64;
+                sinfo->filled |= BIT(NL80211_STA_INFO_TX_BYTES64);
                 sinfo->tx_packets = vif->target_stats.tx_pkt;
-                sinfo->filled |= STATION_INFO_TX_PACKETS;
+                sinfo->filled |= BIT(NL80211_STA_INFO_TX_PACKETS);
         }
 
         sinfo->signal = vif->target_stats.cs_rssi;
-        sinfo->filled |= STATION_INFO_SIGNAL;
+        sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
 
         rate = vif->target_stats.tx_ucast_rate;
 
@@ -1827,6 +1827,7 @@ static int ath6kl_get_station(struct wiphy *wiphy, struct net_device *dev,
                 }
 
                 sinfo->txrate.flags |= RATE_INFO_FLAGS_MCS;
+                sinfo->txrate.bw = RATE_INFO_BW_20;
         } else if (is_rate_ht40(rate, &mcs, &sgi)) {
                 if (sgi) {
                         sinfo->txrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
@@ -1835,7 +1836,7 @@ static int ath6kl_get_station(struct wiphy *wiphy, struct net_device *dev,
                         sinfo->txrate.mcs = mcs;
                 }
 
-                sinfo->txrate.flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
+                sinfo->txrate.bw = RATE_INFO_BW_40;
                 sinfo->txrate.flags |= RATE_INFO_FLAGS_MCS;
         } else {
                 ath6kl_dbg(ATH6KL_DBG_WLAN_CFG,
@@ -1844,12 +1845,12 @@ static int ath6kl_get_station(struct wiphy *wiphy, struct net_device *dev,
                 return 0;
         }
 
-        sinfo->filled |= STATION_INFO_TX_BITRATE;
+        sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
 
         if (test_bit(CONNECTED, &vif->flags) &&
             test_bit(DTIM_PERIOD_AVAIL, &vif->flags) &&
             vif->nw_type == INFRA_NETWORK) {
-                sinfo->filled |= STATION_INFO_BSS_PARAM;
+                sinfo->filled |= BIT(NL80211_STA_INFO_BSS_PARAM);
                 sinfo->bss_param.flags = 0;
                 sinfo->bss_param.dtim_period = vif->assoc_bss_dtim_period;
                 sinfo->bss_param.beacon_interval = vif->assoc_bss_beacon_int;
diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c
index 933aef025698..b42ba46b5030 100644
--- a/drivers/net/wireless/ath/ath6kl/main.c
+++ b/drivers/net/wireless/ath/ath6kl/main.c
@@ -488,7 +488,6 @@ void ath6kl_connect_ap_mode_sta(struct ath6kl_vif *vif, u16 aid, u8 *mac_addr,
 
         sinfo.assoc_req_ies = ies;
         sinfo.assoc_req_ies_len = ies_len;
-        sinfo.filled |= STATION_INFO_ASSOC_REQ_IES;
 
         cfg80211_new_sta(vif->ndev, mac_addr, &sinfo, GFP_KERNEL);
 
diff --git a/drivers/net/wireless/ath/ath9k/ahb.c b/drivers/net/wireless/ath/ath9k/ahb.c
index e000c4c27881..bd4a1a655f42 100644
--- a/drivers/net/wireless/ath/ath9k/ahb.c
+++ b/drivers/net/wireless/ath/ath9k/ahb.c
@@ -43,6 +43,10 @@ static const struct platform_device_id ath9k_platform_id_table[] = {
                 .name = "qca953x_wmac",
                 .driver_data = AR9300_DEVID_AR953X,
         },
+        {
+                .name = "qca956x_wmac",
+                .driver_data = AR9300_DEVID_QCA956X,
+        },
         {},
 };
 
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index ba502a2d199b..ca01d17d130f 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -259,7 +259,8 @@ static void ath9k_hw_set_cck_nil(struct ath_hw *ah, u_int8_t immunityLevel,
                                      entry_cck->fir_step_level);
 
         /* Skip MRC CCK for pre AR9003 families */
-        if (!AR_SREV_9300_20_OR_LATER(ah) || AR_SREV_9485(ah) || AR_SREV_9565(ah))
+        if (!AR_SREV_9300_20_OR_LATER(ah) || AR_SREV_9485(ah) ||
+            AR_SREV_9565(ah) || AR_SREV_9561(ah))
                 return;
 
         if (aniState->mrcCCK != entry_cck->mrc_cck_on)
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index 5829074208fa..f273427fdd29 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -22,6 +22,21 @@
 
 /* All code below is for AR5008, AR9001, AR9002 */
 
+#define AR5008_OFDM_RATES               8
+#define AR5008_HT_SS_RATES              8
+#define AR5008_HT_DS_RATES              8
+
+#define AR5008_HT20_SHIFT               16
+#define AR5008_HT40_SHIFT               24
+
+#define AR5008_11NA_OFDM_SHIFT          0
+#define AR5008_11NA_HT_SS_SHIFT         8
+#define AR5008_11NA_HT_DS_SHIFT         16
+
+#define AR5008_11NG_OFDM_SHIFT          4
+#define AR5008_11NG_HT_SS_SHIFT         12
+#define AR5008_11NG_HT_DS_SHIFT         20
+
 static const int firstep_table[] =
 /* level:  0   1   2   3   4   5   6   7   8  */
         { -4, -2,  0,  2,  4,  6,  8, 10, 12 }; /* lvl 0-8, default 2 */
@@ -1235,6 +1250,71 @@ static void ar5008_hw_set_radar_conf(struct ath_hw *ah)
         conf->radar_inband = 8;
 }
 
+static void ar5008_hw_init_txpower_cck(struct ath_hw *ah, int16_t *rate_array)
+{
+#define CCK_DELTA(x) ((OLC_FOR_AR9280_20_LATER) ? max((x) - 2, 0) : (x))
+        ah->tx_power[0] = CCK_DELTA(rate_array[rate1l]);
+        ah->tx_power[1] = CCK_DELTA(min(rate_array[rate2l],
+                                        rate_array[rate2s]));
+        ah->tx_power[2] = CCK_DELTA(min(rate_array[rate5_5l],
+                                        rate_array[rate5_5s]));
+        ah->tx_power[3] = CCK_DELTA(min(rate_array[rate11l],
+                                        rate_array[rate11s]));
+#undef CCK_DELTA
+}
+
+static void ar5008_hw_init_txpower_ofdm(struct ath_hw *ah, int16_t *rate_array,
+                                        int offset)
+{
+        int i, idx = 0;
+
+        for (i = offset; i < offset + AR5008_OFDM_RATES; i++) {
+                ah->tx_power[i] = rate_array[idx];
+                idx++;
+        }
+}
+
+static void ar5008_hw_init_txpower_ht(struct ath_hw *ah, int16_t *rate_array,
+                                      int ss_offset, int ds_offset,
+                                      bool is_40, int ht40_delta)
+{
+        int i, mcs_idx = (is_40) ? AR5008_HT40_SHIFT : AR5008_HT20_SHIFT;
+
+        for (i = ss_offset; i < ss_offset + AR5008_HT_SS_RATES; i++) {
+                ah->tx_power[i] = rate_array[mcs_idx] + ht40_delta;
+                mcs_idx++;
+        }
+        memcpy(&ah->tx_power[ds_offset], &ah->tx_power[ss_offset],
+               AR5008_HT_SS_RATES);
+}
+
+void ar5008_hw_init_rate_txpower(struct ath_hw *ah, int16_t *rate_array,
+                                 struct ath9k_channel *chan, int ht40_delta)
+{
+        if (IS_CHAN_5GHZ(chan)) {
+                ar5008_hw_init_txpower_ofdm(ah, rate_array,
+                                            AR5008_11NA_OFDM_SHIFT);
+                if (IS_CHAN_HT20(chan) || IS_CHAN_HT40(chan)) {
+                        ar5008_hw_init_txpower_ht(ah, rate_array,
+                                                  AR5008_11NA_HT_SS_SHIFT,
+                                                  AR5008_11NA_HT_DS_SHIFT,
+                                                  IS_CHAN_HT40(chan),
+                                                  ht40_delta);
+                }
+        } else {
+                ar5008_hw_init_txpower_cck(ah, rate_array);
+                ar5008_hw_init_txpower_ofdm(ah, rate_array,
+                                            AR5008_11NG_OFDM_SHIFT);
+                if (IS_CHAN_HT20(chan) || IS_CHAN_HT40(chan)) {
+                        ar5008_hw_init_txpower_ht(ah, rate_array,
+                                                  AR5008_11NG_HT_SS_SHIFT,
+                                                  AR5008_11NG_HT_DS_SHIFT,
+                                                  IS_CHAN_HT40(chan),
+                                                  ht40_delta);
+                }
+        }
+}
+
 int ar5008_hw_attach_phy_ops(struct ath_hw *ah)
 {
         struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
index 06ab71db6e80..174442beb952 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
@@ -1203,24 +1203,41 @@ static void ar9003_hw_tx_iq_cal_reload(struct ath_hw *ah)
 static void ar9003_hw_manual_peak_cal(struct ath_hw *ah, u8 chain, bool is_2g)
 {
         int offset[8] = {0}, total = 0, test;
-        int agc_out, i;
+        int agc_out, i, peak_detect_threshold;
 
+        if (AR_SREV_9550(ah) || AR_SREV_9531(ah))
+                peak_detect_threshold = 8;
+        else
+                peak_detect_threshold = 0;
+
+        /*
+         * Turn off LNA/SW.
+         */
         REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_GAINSTAGES(chain),
                       AR_PHY_65NM_RXRF_GAINSTAGES_RX_OVERRIDE, 0x1);
         REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_GAINSTAGES(chain),
                       AR_PHY_65NM_RXRF_GAINSTAGES_LNAON_CALDC, 0x0);
-        if (is_2g)
-                REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_GAINSTAGES(chain),
-                              AR_PHY_65NM_RXRF_GAINSTAGES_LNA2G_GAIN_OVR, 0x0);
-        else
-                REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_GAINSTAGES(chain),
-                              AR_PHY_65NM_RXRF_GAINSTAGES_LNA5G_GAIN_OVR, 0x0);
 
+        if (AR_SREV_9003_PCOEM(ah) || AR_SREV_9330_11(ah)) {
+                if (is_2g)
+                        REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_GAINSTAGES(chain),
+                                      AR_PHY_65NM_RXRF_GAINSTAGES_LNA2G_GAIN_OVR, 0x0);
+                else
+                        REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_GAINSTAGES(chain),
+                                      AR_PHY_65NM_RXRF_GAINSTAGES_LNA5G_GAIN_OVR, 0x0);
+        }
+
+        /*
+         * Turn off RXON.
+         */
         REG_RMW_FIELD(ah, AR_PHY_65NM_RXTX2(chain),
                       AR_PHY_65NM_RXTX2_RXON_OVR, 0x1);
         REG_RMW_FIELD(ah, AR_PHY_65NM_RXTX2(chain),
                       AR_PHY_65NM_RXTX2_RXON, 0x0);
 
+        /*
+         * Turn on AGC for cal.
+         */
         REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(chain),
                       AR_PHY_65NM_RXRF_AGC_AGC_OVERRIDE, 0x1);
         REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(chain),
@@ -1228,16 +1245,19 @@ static void ar9003_hw_manual_peak_cal(struct ath_hw *ah, u8 chain, bool is_2g)
         REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(chain),
                       AR_PHY_65NM_RXRF_AGC_AGC_CAL_OVR, 0x1);
 
-        if (AR_SREV_9330_11(ah)) {
+        if (AR_SREV_9330_11(ah))
                 REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(chain),
                               AR_PHY_65NM_RXRF_AGC_AGC2G_CALDAC_OVR, 0x0);
-        } else {
+
+        if (AR_SREV_9003_PCOEM(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
                 if (is_2g)
                         REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(chain),
-                                      AR_PHY_65NM_RXRF_AGC_AGC2G_DBDAC_OVR, 0x0);
+                                      AR_PHY_65NM_RXRF_AGC_AGC2G_DBDAC_OVR,
+                                      peak_detect_threshold);
                 else
                         REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(chain),
-                                      AR_PHY_65NM_RXRF_AGC_AGC5G_DBDAC_OVR, 0x0);
+                                      AR_PHY_65NM_RXRF_AGC_AGC5G_DBDAC_OVR,
+                                      peak_detect_threshold);
         }
 
         for (i = 6; i > 0; i--) {
@@ -1266,10 +1286,19 @@ static void ar9003_hw_manual_peak_cal(struct ath_hw *ah, u8 chain, bool is_2g)
                 REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(chain),
                               AR_PHY_65NM_RXRF_AGC_AGC5G_CALDAC_OVR, total);
 
+        /*
+         * Turn on LNA.
+         */
         REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_GAINSTAGES(chain),
                       AR_PHY_65NM_RXRF_GAINSTAGES_RX_OVERRIDE, 0);
+        /*
+         * Turn off RXON.
+         */
         REG_RMW_FIELD(ah, AR_PHY_65NM_RXTX2(chain),
                       AR_PHY_65NM_RXTX2_RXON_OVR, 0);
+        /*
+         * Turn off peak detect calibration.
+         */
         REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(chain),
                       AR_PHY_65NM_RXRF_AGC_AGC_CAL_OVR, 0);
 }
@@ -1611,8 +1640,14 @@ static bool ar9003_hw_init_cal_soc(struct ath_hw *ah,
 
 skip_tx_iqcal:
         if (run_agc_cal || !(ah->ah_flags & AH_FASTCC)) {
-                if (AR_SREV_9330_11(ah))
-                        ar9003_hw_manual_peak_cal(ah, 0, IS_CHAN_2GHZ(chan));
+                if (AR_SREV_9330_11(ah) || AR_SREV_9531(ah) || AR_SREV_9550(ah)) {
+                        for (i = 0; i < AR9300_MAX_CHAINS; i++) {
+                                if (!(ah->rxchainmask & (1 << i)))
+                                        continue;
+                                ar9003_hw_manual_peak_cal(ah, i,
+                                                          IS_CHAN_2GHZ(chan));
+                        }
+                }
 
                 /*
                  * For non-AR9550 chips, we just trigger AGC calibration
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 08225a0067c2..8b4561e8ce1a 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -3536,7 +3536,7 @@ static void ar9003_hw_xpa_bias_level_apply(struct ath_hw *ah, bool is2ghz)
         int bias = ar9003_modal_header(ah, is2ghz)->xpaBiasLvl;
 
         if (AR_SREV_9485(ah) || AR_SREV_9330(ah) || AR_SREV_9340(ah) ||
-            AR_SREV_9531(ah))
+            AR_SREV_9531(ah) || AR_SREV_9561(ah))
                 REG_RMW_FIELD(ah, AR_CH0_TOP2, AR_CH0_TOP2_XPABIASLVL, bias);
         else if (AR_SREV_9462(ah) || AR_SREV_9550(ah) || AR_SREV_9565(ah))
                 REG_RMW_FIELD(ah, AR_CH0_TOP, AR_CH0_TOP_XPABIASLVL, bias);
@@ -3599,7 +3599,7 @@ static void ar9003_hw_ant_ctrl_apply(struct ath_hw *ah, bool is2ghz)
         if (AR_SREV_9462(ah) || AR_SREV_9565(ah)) {
                 REG_RMW_FIELD(ah, AR_PHY_SWITCH_COM,
                                 AR_SWITCH_TABLE_COM_AR9462_ALL, value);
-        } else if (AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
+        } else if (AR_SREV_9550(ah) || AR_SREV_9531(ah) || AR_SREV_9561(ah)) {
                 REG_RMW_FIELD(ah, AR_PHY_SWITCH_COM,
                                 AR_SWITCH_TABLE_COM_AR9550_ALL, value);
         } else
@@ -3929,9 +3929,13 @@ void ar9003_hw_internal_regulator_apply(struct ath_hw *ah)
                         REG_WRITE(ah, AR_PHY_PMU2, reg_pmu_set);
                         if (!is_pmu_set(ah, AR_PHY_PMU2, reg_pmu_set))
                                 return;
-                } else if (AR_SREV_9462(ah) || AR_SREV_9565(ah)) {
+                } else if (AR_SREV_9462(ah) || AR_SREV_9565(ah) ||
+                           AR_SREV_9561(ah)) {
                         reg_val = le32_to_cpu(pBase->swreg);
                         REG_WRITE(ah, AR_PHY_PMU1, reg_val);
+
+                        if (AR_SREV_9561(ah))
+                                REG_WRITE(ah, AR_PHY_PMU2, 0x10200000);
                 } else {
                         /* Internal regulator is ON. Write swreg register. */
                         reg_val = le32_to_cpu(pBase->swreg);
@@ -4034,7 +4038,8 @@ static void ar9003_hw_xpa_timing_control_apply(struct ath_hw *ah, bool is2ghz)
         if (!AR_SREV_9300(ah) &&
             !AR_SREV_9340(ah) &&
             !AR_SREV_9580(ah) &&
-            !AR_SREV_9531(ah))
+            !AR_SREV_9531(ah) &&
+            !AR_SREV_9561(ah))
                 return;
 
         xpa_ctl = ar9003_modal_header(ah, is2ghz)->txFrameToXpaOn;
@@ -4812,7 +4817,7 @@ static void ar9003_hw_power_control_override(struct ath_hw *ah,
         }
 
 tempslope:
-        if (AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
+        if (AR_SREV_9550(ah) || AR_SREV_9531(ah) || AR_SREV_9561(ah)) {
                 u8 txmask = (eep->baseEepHeader.txrxMask & 0xf0) >> 4;
 
                 /*
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_hw.c b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
index 06ad2172030e..4335ccbe7d7e 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
@@ -29,6 +29,7 @@
 #include "ar9565_1p0_initvals.h"
 #include "ar9565_1p1_initvals.h"
 #include "ar953x_initvals.h"
+#include "ar956x_initvals.h"
 
 /* General hardware code for the AR9003 hadware family */
 
@@ -358,6 +359,40 @@ static void ar9003_hw_init_mode_regs(struct ath_hw *ah)
 
                 INIT_INI_ARRAY(&ah->iniModesFastClock,
                                qca953x_1p0_modes_fast_clock);
+        } else if (AR_SREV_9561(ah)) {
+                INIT_INI_ARRAY(&ah->iniMac[ATH_INI_CORE],
+                               qca956x_1p0_mac_core);
+                INIT_INI_ARRAY(&ah->iniMac[ATH_INI_POST],
+                               qca956x_1p0_mac_postamble);
+
+                INIT_INI_ARRAY(&ah->iniBB[ATH_INI_CORE],
+                               qca956x_1p0_baseband_core);
+                INIT_INI_ARRAY(&ah->iniBB[ATH_INI_POST],
+                               qca956x_1p0_baseband_postamble);
+
+                INIT_INI_ARRAY(&ah->iniRadio[ATH_INI_CORE],
+                               qca956x_1p0_radio_core);
+                INIT_INI_ARRAY(&ah->iniRadio[ATH_INI_POST],
+                               qca956x_1p0_radio_postamble);
+
+                INIT_INI_ARRAY(&ah->iniSOC[ATH_INI_PRE],
+                               qca956x_1p0_soc_preamble);
+                INIT_INI_ARRAY(&ah->iniSOC[ATH_INI_POST],
+                               qca956x_1p0_soc_postamble);
+
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                               qca956x_1p0_common_wo_xlna_rx_gain_table);
+                INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
+                               qca956x_1p0_common_wo_xlna_rx_gain_bounds);
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               qca956x_1p0_modes_no_xpa_tx_gain_table);
+
+                INIT_INI_ARRAY(&ah->ini_dfs,
+                               qca956x_1p0_baseband_postamble_dfs_channel);
+                INIT_INI_ARRAY(&ah->iniCckfirJapan2484,
+                               qca956x_1p0_baseband_core_txfir_coeff_japan_2484);
+                INIT_INI_ARRAY(&ah->iniModesFastClock,
+                               qca956x_1p0_modes_fast_clock);
         } else if (AR_SREV_9580(ah)) {
                 /* mac */
                 INIT_INI_ARRAY(&ah->iniMac[ATH_INI_CORE],
@@ -544,6 +579,9 @@ static void ar9003_tx_gain_table_mode0(struct ath_hw *ah)
         else if (AR_SREV_9531_20(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                                qca953x_2p0_modes_xpa_tx_gain_table);
+        else if (AR_SREV_9561(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               qca956x_1p0_modes_xpa_tx_gain_table);
         else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9580_1p0_lowest_ob_db_tx_gain_table);
@@ -594,7 +632,10 @@ static void ar9003_tx_gain_table_mode1(struct ath_hw *ah)
                 else
                         INIT_INI_ARRAY(&ah->iniModesTxGain,
                                        qca953x_1p0_modes_no_xpa_tx_gain_table);
-        } else if (AR_SREV_9462_21(ah))
+        } else if (AR_SREV_9561(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               qca956x_1p0_modes_no_xpa_tx_gain_table);
+        else if (AR_SREV_9462_21(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9462_2p1_modes_high_ob_db_tx_gain);
         else if (AR_SREV_9462_20(ah))
@@ -628,6 +669,9 @@ static void ar9003_tx_gain_table_mode2(struct ath_hw *ah)
         else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9580_1p0_low_ob_db_tx_gain_table);
+        else if (AR_SREV_9561(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               qca956x_1p0_modes_no_xpa_low_ob_db_tx_gain_table);
         else if (AR_SREV_9565_11(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                                ar9565_1p1_modes_low_ob_db_tx_gain_table);
@@ -699,6 +743,9 @@ static void ar9003_tx_gain_table_mode5(struct ath_hw *ah)
         else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9580_1p0_type5_tx_gain_table);
+        else if (AR_SREV_9561(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               qca956x_1p0_modes_no_xpa_green_tx_gain_table);
         else if (AR_SREV_9300_22(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9300Modes_type5_tx_gain_table_2p2);
@@ -770,6 +817,13 @@ static void ar9003_rx_gain_table_mode0(struct ath_hw *ah)
                                qca953x_1p0_common_rx_gain_table);
                 INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
                                qca953x_1p0_common_rx_gain_bounds);
+        } else if (AR_SREV_9561(ah)) {
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                               qca956x_1p0_common_rx_gain_table);
+                INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
+                               qca956x_1p0_common_rx_gain_bounds);
+                INIT_INI_ARRAY(&ah->ini_modes_rxgain_5g_xlna,
+                               qca956x_1p0_xlna_only);
         } else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                                 ar9580_1p0_rx_gain_table);
@@ -825,6 +879,11 @@ static void ar9003_rx_gain_table_mode1(struct ath_hw *ah)
                                qca953x_2p0_common_wo_xlna_rx_gain_table);
                 INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
                                qca953x_2p0_common_wo_xlna_rx_gain_bounds);
+        } else if (AR_SREV_9561(ah)) {
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                               qca956x_1p0_common_wo_xlna_rx_gain_table);
+                INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
+                               qca956x_1p0_common_wo_xlna_rx_gain_bounds);
         } else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                         ar9580_1p0_wo_xlna_rx_gain_table);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index ae6cde273414..1ad66b76749b 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -183,7 +183,8 @@ static int ar9003_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan)
                         } else {
                                 channelSel = CHANSEL_2G(freq) >> 1;
                         }
-                } else if (AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
+                } else if (AR_SREV_9550(ah) || AR_SREV_9531(ah) ||
+                           AR_SREV_9561(ah)) {
                         if (ah->is_clk_25mhz)
                                 div = 75;
                         else
@@ -198,7 +199,8 @@ static int ar9003_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan)
                 /* Set to 2G mode */
                 bMode = 1;
         } else {
-                if ((AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah)) &&
+                if ((AR_SREV_9340(ah) || AR_SREV_9550(ah) ||
+                     AR_SREV_9531(ah) || AR_SREV_9561(ah)) &&
                     ah->is_clk_25mhz) {
                         channelSel = freq / 75;
                         chan_frac = ((freq % 75) * 0x20000) / 75;
@@ -265,7 +267,7 @@ static void ar9003_hw_spur_mitigate_mrc_cck(struct ath_hw *ah,
          */
 
         if (AR_SREV_9485(ah) || AR_SREV_9340(ah) || AR_SREV_9330(ah) ||
-            AR_SREV_9550(ah)) {
+            AR_SREV_9550(ah) || AR_SREV_9561(ah)) {
                 if (spur_fbin_ptr[0] == 0) /* No spur */
                         return;
                 max_spur_cnts = 5;
@@ -292,7 +294,7 @@ static void ar9003_hw_spur_mitigate_mrc_cck(struct ath_hw *ah,
 
                 negative = 0;
                 if (AR_SREV_9485(ah) || AR_SREV_9340(ah) || AR_SREV_9330(ah) ||
-                    AR_SREV_9550(ah))
+                    AR_SREV_9550(ah) || AR_SREV_9561(ah))
                         cur_bb_spur = ath9k_hw_fbin2freq(spur_fbin_ptr[i],
                                                          IS_CHAN_2GHZ(chan));
                 else
@@ -641,8 +643,10 @@ static void ar9003_hw_set_channel_regs(struct ath_hw *ah,
                 (REG_READ(ah, AR_PHY_GEN_CTRL) & AR_PHY_GC_ENABLE_DAC_FIFO);
 
         /* Enable 11n HT, 20 MHz */
-        phymode = AR_PHY_GC_HT_EN | AR_PHY_GC_SINGLE_HT_LTF1 |
-                  AR_PHY_GC_SHORT_GI_40 | enableDacFifo;
+        phymode = AR_PHY_GC_HT_EN | AR_PHY_GC_SHORT_GI_40 | enableDacFifo;
+
+        if (!AR_SREV_9561(ah))
+                phymode |= AR_PHY_GC_SINGLE_HT_LTF1;
 
         /* Configure baseband for dynamic 20/40 operation */
         if (IS_CHAN_HT40(chan)) {
@@ -745,7 +749,8 @@ static void ar9003_hw_override_ini(struct ath_hw *ah)
         else
                 ah->enabled_cals &= ~TX_CL_CAL;
 
-        if (AR_SREV_9340(ah) || AR_SREV_9531(ah) || AR_SREV_9550(ah)) {
+        if (AR_SREV_9340(ah) || AR_SREV_9531(ah) || AR_SREV_9550(ah) ||
+            AR_SREV_9561(ah)) {
                 if (ah->is_clk_25mhz) {
                         REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x17c << 1);
                         REG_WRITE(ah, AR_SLP32_MODE, 0x0010f3d7);
@@ -812,6 +817,19 @@ static int ar9550_hw_get_modes_txgain_index(struct ath_hw *ah,
         return ret;
 }
 
+static int ar9561_hw_get_modes_txgain_index(struct ath_hw *ah,
+                                            struct ath9k_channel *chan)
+{
+        if (IS_CHAN_2GHZ(chan)) {
+                if (IS_CHAN_HT40(chan))
+                        return 1;
+                else
+                        return 2;
+        }
+
+        return 0;
+}
+
 static void ar9003_doubler_fix(struct ath_hw *ah)
 {
         if (AR_SREV_9300(ah) || AR_SREV_9580(ah) || AR_SREV_9550(ah)) {
@@ -911,21 +929,29 @@ static int ar9003_hw_process_ini(struct ath_hw *ah,
                         REG_WRITE_ARRAY(&ah->ini_modes_rxgain_5g_xlna,
                                         modesIndex, regWrites);
                 }
+
+                if (AR_SREV_9561(ah) && (ar9003_hw_get_rx_gain_idx(ah) == 0))
+                        REG_WRITE_ARRAY(&ah->ini_modes_rxgain_5g_xlna,
+                                        modesIndex, regWrites);
         }
 
-        if (AR_SREV_9550(ah))
+        if (AR_SREV_9550(ah) || AR_SREV_9561(ah))
                 REG_WRITE_ARRAY(&ah->ini_modes_rx_gain_bounds, modesIndex,
                                 regWrites);
 
         /*
          * TXGAIN initvals.
          */
-        if (AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
+        if (AR_SREV_9550(ah) || AR_SREV_9531(ah) || AR_SREV_9561(ah)) {
                 int modes_txgain_index = 1;
 
                 if (AR_SREV_9550(ah))
                         modes_txgain_index = ar9550_hw_get_modes_txgain_index(ah, chan);
 
+                if (AR_SREV_9561(ah))
+                        modes_txgain_index =
+                                ar9561_hw_get_modes_txgain_index(ah, chan);
+
                 if (modes_txgain_index < 0)
                         return -EINVAL;
 
@@ -1989,7 +2015,8 @@ void ar9003_hw_attach_phy_ops(struct ath_hw *ah)
         priv_ops->rf_set_freq = ar9003_hw_set_channel;
         priv_ops->spur_mitigate_freq = ar9003_hw_spur_mitigate;
 
-        if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah))
+        if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah) ||
+            AR_SREV_9561(ah))
                 priv_ops->compute_pll_control = ar9003_hw_compute_pll_control_soc;
         else
                 priv_ops->compute_pll_control = ar9003_hw_compute_pll_control;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
index fd090b1f2d0f..c311b2bfdb00 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
@@ -454,7 +454,7 @@
 #define AR_PHY_GEN_CTRL          (AR_SM_BASE + 0x4)
 #define AR_PHY_MODE              (AR_SM_BASE + 0x8)
 #define AR_PHY_ACTIVE            (AR_SM_BASE + 0xc)
-#define AR_PHY_SPUR_MASK_A       (AR_SM_BASE + 0x20)
+#define AR_PHY_SPUR_MASK_A       (AR_SM_BASE + (AR_SREV_9561(ah) ? 0x18 : 0x20))
 #define AR_PHY_SPUR_MASK_B       (AR_SM_BASE + 0x24)
 #define AR_PHY_SPECTRAL_SCAN     (AR_SM_BASE + 0x28)
 #define AR_PHY_RADAR_BW_FILTER   (AR_SM_BASE + 0x2c)
@@ -506,7 +506,7 @@
 #define AR_PHY_TEST_CHAIN_SEL      0xC0000000
 #define AR_PHY_TEST_CHAIN_SEL_S    30
 
-#define AR_PHY_TEST_CTL_STATUS   (AR_SM_BASE + 0x164)
+#define AR_PHY_TEST_CTL_STATUS   (AR_SM_BASE + (AR_SREV_9561(ah) ? 0x160 : 0x164))
 #define AR_PHY_TEST_CTL_TSTDAC_EN         0x1
 #define AR_PHY_TEST_CTL_TSTDAC_EN_S       0
 #define AR_PHY_TEST_CTL_TX_OBS_SEL        0x1C
@@ -525,7 +525,7 @@
 
 #define AR_PHY_CHAN_STATUS       (AR_SM_BASE + 0x16c)
 
-#define AR_PHY_CHAN_INFO_MEMORY                         (AR_SM_BASE + 0x170)
+#define AR_PHY_CHAN_INFO_MEMORY (AR_SM_BASE + (AR_SREV_9561(ah) ? 0x16c : 0x170))
 #define AR_PHY_CHAN_INFO_MEMORY_CHANINFOMEM_S2_READ     0x00000008
 #define AR_PHY_CHAN_INFO_MEMORY_CHANINFOMEM_S2_READ_S   3
 
@@ -536,7 +536,7 @@
 #define AR_PHY_SCRAMBLER_SEED    (AR_SM_BASE + 0x190)
 #define AR_PHY_CCK_TX_CTRL       (AR_SM_BASE + 0x194)
 
-#define AR_PHY_HEAVYCLIP_CTL     (AR_SM_BASE + 0x1a4)
+#define AR_PHY_HEAVYCLIP_CTL     (AR_SM_BASE + (AR_SREV_9561(ah) ? 0x198 : 0x1a4))
 #define AR_PHY_HEAVYCLIP_20      (AR_SM_BASE + 0x1a8)
 #define AR_PHY_HEAVYCLIP_40      (AR_SM_BASE + 0x1ac)
 #define AR_PHY_ILLEGAL_TXRATE    (AR_SM_BASE + 0x1b0)
@@ -726,21 +726,24 @@
 
 #define AR_CH0_TOP2             (AR_SREV_9300(ah) ? 0x1628c : \
                                         (AR_SREV_9462(ah) ? 0x16290 : 0x16284))
-#define AR_CH0_TOP2_XPABIASLVL          0xf000
+#define AR_CH0_TOP2_XPABIASLVL          (AR_SREV_9561(ah) ? 0x1e00 : 0xf000)
 #define AR_CH0_TOP2_XPABIASLVL_S        12
 
 #define AR_CH0_XTAL             (AR_SREV_9300(ah) ? 0x16294 : \
-                                 ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x16298 : 0x16290))
+                                 ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x16298 : \
+                                  (AR_SREV_9561(ah) ? 0x162c0 : 0x16290)))
 #define AR_CH0_XTAL_CAPINDAC    0x7f000000
 #define AR_CH0_XTAL_CAPINDAC_S  24
 #define AR_CH0_XTAL_CAPOUTDAC   0x00fe0000
 #define AR_CH0_XTAL_CAPOUTDAC_S 17
 
-#define AR_PHY_PMU1             ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x16340 : 0x16c40)
+#define AR_PHY_PMU1             ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x16340 : \
+                                 (AR_SREV_9561(ah) ? 0x16cc0 : 0x16c40))
 #define AR_PHY_PMU1_PWD         0x1
 #define AR_PHY_PMU1_PWD_S       0
 
-#define AR_PHY_PMU2             ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x16344 : 0x16c44)
+#define AR_PHY_PMU2             ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x16344 : \
+                                 (AR_SREV_9561(ah) ? 0x16cc4 : 0x16c44))
 #define AR_PHY_PMU2_PGM         0x00200000
 #define AR_PHY_PMU2_PGM_S       21
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_wow.c b/drivers/net/wireless/ath/ath9k/ar9003_wow.c
index 81c88dd606dc..86bfc9604dca 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_wow.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_wow.c
@@ -17,23 +17,9 @@
 #include <linux/export.h>
 #include "ath9k.h"
 #include "reg.h"
+#include "reg_wow.h"
 #include "hw-ops.h"
 
-const char *ath9k_hw_wow_event_to_string(u32 wow_event)
-{
-        if (wow_event & AH_WOW_MAGIC_PATTERN_EN)
-                return "Magic pattern";
-        if (wow_event & AH_WOW_USER_PATTERN_EN)
-                return "User pattern";
-        if (wow_event & AH_WOW_LINK_CHANGE)
-                return "Link change";
-        if (wow_event & AH_WOW_BEACON_MISS)
-                return "Beacon miss";
-
-        return  "unknown reason";
-}
-EXPORT_SYMBOL(ath9k_hw_wow_event_to_string);
-
 static void ath9k_hw_set_powermode_wow_sleep(struct ath_hw *ah)
 {
         struct ath_common *common = ath9k_hw_common(ah);
@@ -49,6 +35,15 @@ static void ath9k_hw_set_powermode_wow_sleep(struct ath_hw *ah)
                 return;
         }
 
+        if (AR_SREV_9462(ah) || AR_SREV_9565(ah)) {
+                if (!REG_READ(ah, AR_MAC_PCU_GEN_TIMER_TSF_SEL))
+                        REG_CLR_BIT(ah, AR_DIRECT_CONNECT, AR_DC_TSF2_ENABLE);
+        } else if (AR_SREV_9485(ah)){
+                if (!(REG_READ(ah, AR_NDP2_TIMER_MODE) &
+                      AR_GEN_TIMERS2_MODE_ENABLE_MASK))
+                        REG_CLR_BIT(ah, AR_DIRECT_CONNECT, AR_DC_TSF2_ENABLE);
+        }
+
         REG_WRITE(ah, AR_RTC_FORCE_WAKE, AR_RTC_FORCE_WAKE_ON_INT);
 }
 
@@ -67,11 +62,15 @@ static void ath9k_wow_create_keep_alive_pattern(struct ath_hw *ah)
         /* set the transmit buffer */
         ctl[0] = (KAL_FRAME_LEN | (MAX_RATE_POWER << 16));
         ctl[1] = 0;
-        ctl[3] = 0xb;   /* OFDM_6M hardware value for this rate */
         ctl[4] = 0;
         ctl[7] = (ah->txchainmask) << 2;
         ctl[2] = 0xf << 16; /* tx_tries 0 */
 
+        if (IS_CHAN_2GHZ(ah->curchan))
+                ctl[3] = 0x1b;  /* CCK_1M */
+        else
+                ctl[3] = 0xb;   /* OFDM_6M */
+
         for (i = 0; i < KAL_NUM_DESC_WORDS; i++)
                 REG_WRITE(ah, (AR_WOW_KA_DESC_WORD2 + i * 4), ctl[i]);
 
@@ -103,21 +102,22 @@ static void ath9k_wow_create_keep_alive_pattern(struct ath_hw *ah)
 
 }
 
-void ath9k_hw_wow_apply_pattern(struct ath_hw *ah, u8 *user_pattern,
-                                u8 *user_mask, int pattern_count,
-                                int pattern_len)
+int ath9k_hw_wow_apply_pattern(struct ath_hw *ah, u8 *user_pattern,
+                               u8 *user_mask, int pattern_count,
+                               int pattern_len)
 {
         int i;
         u32 pattern_val, mask_val;
         u32 set, clr;
 
-        /* FIXME: should check count by querying the hardware capability */
-        if (pattern_count >= MAX_NUM_PATTERN)
-                return;
+        if (pattern_count >= ah->wow.max_patterns)
+                return -ENOSPC;
 
-        REG_SET_BIT(ah, AR_WOW_PATTERN, BIT(pattern_count));
+        if (pattern_count < MAX_NUM_PATTERN_LEGACY)
+                REG_SET_BIT(ah, AR_WOW_PATTERN, BIT(pattern_count));
+        else
+                REG_SET_BIT(ah, AR_MAC_PCU_WOW4, BIT(pattern_count - 8));
 
-        /* set the registers for pattern */
         for (i = 0; i < MAX_PATTERN_SIZE; i += 4) {
                 memcpy(&pattern_val, user_pattern, 4);
                 REG_WRITE(ah, (AR_WOW_TB_PATTERN(pattern_count) + i),
@@ -125,49 +125,42 @@ void ath9k_hw_wow_apply_pattern(struct ath_hw *ah, u8 *user_pattern,
                 user_pattern += 4;
         }
 
-        /* set the registers for mask */
         for (i = 0; i < MAX_PATTERN_MASK_SIZE; i += 4) {
                 memcpy(&mask_val, user_mask, 4);
                 REG_WRITE(ah, (AR_WOW_TB_MASK(pattern_count) + i), mask_val);
                 user_mask += 4;
         }
 
-        /* set the pattern length to be matched
-         *
-         * AR_WOW_LENGTH1_REG1
-         * bit 31:24 pattern 0 length
-         * bit 23:16 pattern 1 length
-         * bit 15:8 pattern 2 length
-         * bit 7:0 pattern 3 length
-         *
-         * AR_WOW_LENGTH1_REG2
-         * bit 31:24 pattern 4 length
-         * bit 23:16 pattern 5 length
-         * bit 15:8 pattern 6 length
-         * bit 7:0 pattern 7 length
-         *
-         * the below logic writes out the new
-         * pattern length for the corresponding
-         * pattern_count, while masking out the
-         * other fields
-         */
-
-        ah->wow_event_mask |= BIT(pattern_count + AR_WOW_PAT_FOUND_SHIFT);
+        if (pattern_count < MAX_NUM_PATTERN_LEGACY)
+                ah->wow.wow_event_mask |=
+                        BIT(pattern_count + AR_WOW_PAT_FOUND_SHIFT);
+        else
+                ah->wow.wow_event_mask2 |=
+                        BIT((pattern_count - 8) + AR_WOW_PAT_FOUND_SHIFT);
 
         if (pattern_count < 4) {
-                /* Pattern 0-3 uses AR_WOW_LENGTH1 register */
                 set = (pattern_len & AR_WOW_LENGTH_MAX) <<
                        AR_WOW_LEN1_SHIFT(pattern_count);
                 clr = AR_WOW_LENGTH1_MASK(pattern_count);
                 REG_RMW(ah, AR_WOW_LENGTH1, set, clr);
-        } else {
-                /* Pattern 4-7 uses AR_WOW_LENGTH2 register */
+        } else if (pattern_count < 8) {
                 set = (pattern_len & AR_WOW_LENGTH_MAX) <<
                        AR_WOW_LEN2_SHIFT(pattern_count);
                 clr = AR_WOW_LENGTH2_MASK(pattern_count);
                 REG_RMW(ah, AR_WOW_LENGTH2, set, clr);
+        } else if (pattern_count < 12) {
+                set = (pattern_len & AR_WOW_LENGTH_MAX) <<
+                       AR_WOW_LEN3_SHIFT(pattern_count);
+                clr = AR_WOW_LENGTH3_MASK(pattern_count);
+                REG_RMW(ah, AR_WOW_LENGTH3, set, clr);
+        } else if (pattern_count < MAX_NUM_PATTERN) {
+                set = (pattern_len & AR_WOW_LENGTH_MAX) <<
+                       AR_WOW_LEN4_SHIFT(pattern_count);
+                clr = AR_WOW_LENGTH4_MASK(pattern_count);
+                REG_RMW(ah, AR_WOW_LENGTH4, set, clr);
         }
 
+        return 0;
 }
 EXPORT_SYMBOL(ath9k_hw_wow_apply_pattern);
 
@@ -189,7 +182,7 @@ u32 ath9k_hw_wow_wakeup(struct ath_hw *ah)
          * register. This mask will clean it up.
          */
 
-        val &= ah->wow_event_mask;
+        val &= ah->wow.wow_event_mask;
 
         if (val) {
                 if (val & AR_WOW_MAGIC_PAT_FOUND)
@@ -233,190 +226,192 @@ u32 ath9k_hw_wow_wakeup(struct ath_hw *ah)
         if (ah->is_pciexpress)
                 ath9k_hw_configpcipowersave(ah, false);
 
-        ah->wow_event_mask = 0;
+        ah->wow.wow_event_mask = 0;
 
         return wow_status;
 }
 EXPORT_SYMBOL(ath9k_hw_wow_wakeup);
 
-void ath9k_hw_wow_enable(struct ath_hw *ah, u32 pattern_enable)
+static void ath9k_hw_wow_set_arwr_reg(struct ath_hw *ah)
 {
-        u32 wow_event_mask;
-        u32 set, clr;
+        u32 wa_reg;
 
-        /*
-         * wow_event_mask is a mask to the AR_WOW_PATTERN register to
-         * indicate which WoW events we have enabled. The WoW events
-         * are from the 'pattern_enable' in this function and
-         * 'pattern_count' of ath9k_hw_wow_apply_pattern()
-         */
-        wow_event_mask = ah->wow_event_mask;
+        if (!ah->is_pciexpress)
+                return;
 
         /*
-         * Untie Power-on-Reset from the PCI-E-Reset. When we are in
-         * WOW sleep, we do want the Reset from the PCI-E to disturb
-         * our hw state
+         * We need to untie the internal POR (power-on-reset)
+         * to the external PCI-E reset. We also need to tie
+         * the PCI-E Phy reset to the PCI-E reset.
          */
-        if (ah->is_pciexpress) {
-                /*
-                 * we need to untie the internal POR (power-on-reset)
-                 * to the external PCI-E reset. We also need to tie
-                 * the PCI-E Phy reset to the PCI-E reset.
-                 */
-                set = AR_WA_RESET_EN | AR_WA_POR_SHORT;
-                clr = AR_WA_UNTIE_RESET_EN | AR_WA_D3_L1_DISABLE;
-                REG_RMW(ah, AR_WA, set, clr);
-        }
+        wa_reg = REG_READ(ah, AR_WA);
+        wa_reg &= ~AR_WA_UNTIE_RESET_EN;
+        wa_reg |= AR_WA_RESET_EN;
+        wa_reg |= AR_WA_POR_SHORT;
 
-        /*
-         * set the power states appropriately and enable PME
-         */
-        set = AR_PMCTRL_HOST_PME_EN | AR_PMCTRL_PWR_PM_CTRL_ENA |
-              AR_PMCTRL_AUX_PWR_DET | AR_PMCTRL_WOW_PME_CLR;
+        REG_WRITE(ah, AR_WA, wa_reg);
+}
+
+void ath9k_hw_wow_enable(struct ath_hw *ah, u32 pattern_enable)
+{
+        u32 wow_event_mask;
+        u32 keep_alive, magic_pattern, host_pm_ctrl;
+
+        wow_event_mask = ah->wow.wow_event_mask;
 
         /*
-         * set and clear WOW_PME_CLEAR registers for the chip
+         * AR_PMCTRL_HOST_PME_EN - Override PME enable in configuration
+         *                         space and allow MAC to generate WoW anyway.
+         *
+         * AR_PMCTRL_PWR_PM_CTRL_ENA - ???
+         *
+         * AR_PMCTRL_AUX_PWR_DET - PCI core SYS_AUX_PWR_DET signal,
+         *                         needs to be set for WoW in PCI mode.
+         *
+         * AR_PMCTRL_WOW_PME_CLR - WoW Clear Signal going to the MAC.
+         *
+         * Set the power states appropriately and enable PME.
+         *
+         * Set and clear WOW_PME_CLEAR for the chip
          * to generate next wow signal.
          */
-        REG_SET_BIT(ah, AR_PCIE_PM_CTRL, set);
-        clr = AR_PMCTRL_WOW_PME_CLR;
-        REG_CLR_BIT(ah, AR_PCIE_PM_CTRL, clr);
+        REG_SET_BIT(ah, AR_PCIE_PM_CTRL, AR_PMCTRL_HOST_PME_EN |
+                                         AR_PMCTRL_PWR_PM_CTRL_ENA |
+                                         AR_PMCTRL_AUX_PWR_DET |
+                                         AR_PMCTRL_WOW_PME_CLR);
+        REG_CLR_BIT(ah, AR_PCIE_PM_CTRL, AR_PMCTRL_WOW_PME_CLR);
 
         /*
-         * Setup for:
-         *      - beacon misses
-         *      - magic pattern
-         *      - keep alive timeout
-         *      - pattern matching
+         * Random Backoff.
+         *
+         * 31:28 in AR_WOW_PATTERN : Indicates the number of bits used in the
+         *                           contention window. For value N,
+         *                           the random backoff will be selected between
+         *                           0 and (2 ^ N) - 1.
          */
+        REG_SET_BIT(ah, AR_WOW_PATTERN,
+                    AR_WOW_BACK_OFF_SHIFT(AR_WOW_PAT_BACKOFF));
 
         /*
-         * Program default values for pattern backoff, aifs/slot/KAL count,
-         * beacon miss timeout, KAL timeout, etc.
+         * AIFS time, Slot time, Keep Alive count.
+         */
+        REG_SET_BIT(ah, AR_WOW_COUNT, AR_WOW_AIFS_CNT(AR_WOW_CNT_AIFS_CNT) |
+                                      AR_WOW_SLOT_CNT(AR_WOW_CNT_SLOT_CNT) |
+                                      AR_WOW_KEEP_ALIVE_CNT(AR_WOW_CNT_KA_CNT));
+        /*
+         * Beacon timeout.
          */
-        set = AR_WOW_BACK_OFF_SHIFT(AR_WOW_PAT_BACKOFF);
-        REG_SET_BIT(ah, AR_WOW_PATTERN, set);
-
-        set = AR_WOW_AIFS_CNT(AR_WOW_CNT_AIFS_CNT) |
-              AR_WOW_SLOT_CNT(AR_WOW_CNT_SLOT_CNT) |
-              AR_WOW_KEEP_ALIVE_CNT(AR_WOW_CNT_KA_CNT);
-        REG_SET_BIT(ah, AR_WOW_COUNT, set);
-
         if (pattern_enable & AH_WOW_BEACON_MISS)
-                set = AR_WOW_BEACON_TIMO;
-        /* We are not using beacon miss, program a large value */
+                REG_WRITE(ah, AR_WOW_BCN_TIMO, AR_WOW_BEACON_TIMO);
         else
-                set = AR_WOW_BEACON_TIMO_MAX;
-
-        REG_WRITE(ah, AR_WOW_BCN_TIMO, set);
+                REG_WRITE(ah, AR_WOW_BCN_TIMO, AR_WOW_BEACON_TIMO_MAX);
 
         /*
-         * Keep alive timo in ms except AR9280
+         * Keep alive timeout in ms.
          */
         if (!pattern_enable)
-                set = AR_WOW_KEEP_ALIVE_NEVER;
+                REG_WRITE(ah, AR_WOW_KEEP_ALIVE_TIMO, AR_WOW_KEEP_ALIVE_NEVER);
         else
-                set = KAL_TIMEOUT * 32;
-
-        REG_WRITE(ah, AR_WOW_KEEP_ALIVE_TIMO, set);
+                REG_WRITE(ah, AR_WOW_KEEP_ALIVE_TIMO, KAL_TIMEOUT * 32);
 
         /*
-         * Keep alive delay in us. based on 'power on clock',
-         * therefore in usec
+         * Keep alive delay in us.
          */
-        set = KAL_DELAY * 1000;
-        REG_WRITE(ah, AR_WOW_KEEP_ALIVE_DELAY, set);
+        REG_WRITE(ah, AR_WOW_KEEP_ALIVE_DELAY, KAL_DELAY * 1000);
 
         /*
-         * Create keep alive pattern to respond to beacons
+         * Create keep alive pattern to respond to beacons.
          */
         ath9k_wow_create_keep_alive_pattern(ah);
 
         /*
-         * Configure MAC WoW Registers
+         * Configure keep alive register.
          */
-        set = 0;
+        keep_alive = REG_READ(ah, AR_WOW_KEEP_ALIVE);
+
         /* Send keep alive timeouts anyway */
-        clr = AR_WOW_KEEP_ALIVE_AUTO_DIS;
+        keep_alive &= ~AR_WOW_KEEP_ALIVE_AUTO_DIS;
 
-        if (pattern_enable & AH_WOW_LINK_CHANGE)
+        if (pattern_enable & AH_WOW_LINK_CHANGE) {
+                keep_alive &= ~AR_WOW_KEEP_ALIVE_FAIL_DIS;
                 wow_event_mask |= AR_WOW_KEEP_ALIVE_FAIL;
-        else
-                set = AR_WOW_KEEP_ALIVE_FAIL_DIS;
+        } else {
+                keep_alive |= AR_WOW_KEEP_ALIVE_FAIL_DIS;
+        }
 
-        set = AR_WOW_KEEP_ALIVE_FAIL_DIS;
-        REG_RMW(ah, AR_WOW_KEEP_ALIVE, set, clr);
+        REG_WRITE(ah, AR_WOW_KEEP_ALIVE, keep_alive);
 
         /*
-         * we are relying on a bmiss failure. ensure we have
-         * enough threshold to prevent false positives
+         * We are relying on a bmiss failure, ensure we have
+         * enough threshold to prevent false positives.
          */
         REG_RMW_FIELD(ah, AR_RSSI_THR, AR_RSSI_THR_BM_THR,
                       AR_WOW_BMISSTHRESHOLD);
 
-        set = 0;
-        clr = 0;
-
         if (pattern_enable & AH_WOW_BEACON_MISS) {
-                set = AR_WOW_BEACON_FAIL_EN;
                 wow_event_mask |= AR_WOW_BEACON_FAIL;
+                REG_SET_BIT(ah, AR_WOW_BCN_EN, AR_WOW_BEACON_FAIL_EN);
         } else {
-                clr = AR_WOW_BEACON_FAIL_EN;
+                REG_CLR_BIT(ah, AR_WOW_BCN_EN, AR_WOW_BEACON_FAIL_EN);
         }
 
-        REG_RMW(ah, AR_WOW_BCN_EN, set, clr);
-
-        set = 0;
-        clr = 0;
         /*
-         * Enable the magic packet registers
+         * Enable the magic packet registers.
          */
+        magic_pattern = REG_READ(ah, AR_WOW_PATTERN);
+        magic_pattern |= AR_WOW_MAC_INTR_EN;
+
         if (pattern_enable & AH_WOW_MAGIC_PATTERN_EN) {
-                set = AR_WOW_MAGIC_EN;
+                magic_pattern |= AR_WOW_MAGIC_EN;
                 wow_event_mask |= AR_WOW_MAGIC_PAT_FOUND;
         } else {
-                clr = AR_WOW_MAGIC_EN;
+                magic_pattern &= ~AR_WOW_MAGIC_EN;
         }
-        set |= AR_WOW_MAC_INTR_EN;
-        REG_RMW(ah, AR_WOW_PATTERN, set, clr);
 
+        REG_WRITE(ah, AR_WOW_PATTERN, magic_pattern);
+
+        /*
+         * Enable pattern matching for packets which are less
+         * than 256 bytes.
+         */
         REG_WRITE(ah, AR_WOW_PATTERN_MATCH_LT_256B,
                   AR_WOW_PATTERN_SUPPORTED);
 
         /*
-         * Set the power states appropriately and enable PME
+         * Set the power states appropriately and enable PME.
          */
-        clr = 0;
-        set = AR_PMCTRL_PWR_STATE_D1D3 | AR_PMCTRL_HOST_PME_EN |
-              AR_PMCTRL_PWR_PM_CTRL_ENA;
+        host_pm_ctrl = REG_READ(ah, AR_PCIE_PM_CTRL);
+        host_pm_ctrl |= AR_PMCTRL_PWR_STATE_D1D3 |
+                        AR_PMCTRL_HOST_PME_EN |
+                        AR_PMCTRL_PWR_PM_CTRL_ENA;
+        host_pm_ctrl &= ~AR_PCIE_PM_CTRL_ENA;
 
-        clr = AR_PCIE_PM_CTRL_ENA;
-        REG_RMW(ah, AR_PCIE_PM_CTRL, set, clr);
+        if (AR_SREV_9462(ah)) {
+                /*
+                 * This is needed to prevent the chip waking up
+                 * the host within 3-4 seconds with certain
+                 * platform/BIOS.
+                 */
+                host_pm_ctrl &= ~AR_PMCTRL_PWR_STATE_D1D3;
+                host_pm_ctrl |= AR_PMCTRL_PWR_STATE_D1D3_REAL;
+        }
+
+        REG_WRITE(ah, AR_PCIE_PM_CTRL, host_pm_ctrl);
 
         /*
-         * this is needed to prevent the chip waking up
-         * the host within 3-4 seconds with certain
-         * platform/BIOS. The fix is to enable
-         * D1 & D3 to match original definition and
-         * also match the OTP value. Anyway this
-         * is more related to SW WOW.
+         * Enable sequence number generation when asleep.
          */
-        clr = AR_PMCTRL_PWR_STATE_D1D3;
-        REG_CLR_BIT(ah, AR_PCIE_PM_CTRL, clr);
+        REG_CLR_BIT(ah, AR_STA_ID1, AR_STA_ID1_PRESERVE_SEQNUM);
 
-        set = AR_PMCTRL_PWR_STATE_D1D3_REAL;
-        REG_SET_BIT(ah, AR_PCIE_PM_CTRL, set);
+        /* To bring down WOW power low margin */
+        REG_SET_BIT(ah, AR_PCIE_PHY_REG3, BIT(13));
 
-        REG_CLR_BIT(ah, AR_STA_ID1, AR_STA_ID1_PRESERVE_SEQNUM);
+        ath9k_hw_wow_set_arwr_reg(ah);
 
-        /* to bring down WOW power low margin */
-        set = BIT(13);
-        REG_SET_BIT(ah, AR_PCIE_PHY_REG3, set);
         /* HW WoW */
-        clr = BIT(5);
-        REG_CLR_BIT(ah, AR_PCU_MISC_MODE3, clr);
+        REG_CLR_BIT(ah, AR_PCU_MISC_MODE3, BIT(5));
 
         ath9k_hw_set_powermode_wow_sleep(ah);
-        ah->wow_event_mask = wow_event_mask;
+        ah->wow.wow_event_mask = wow_event_mask;
 }
 EXPORT_SYMBOL(ath9k_hw_wow_enable);
diff --git a/drivers/net/wireless/ath/ath9k/ar953x_initvals.h b/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
index 159cc6fd2362..6fc0d07e5ec6 100644
--- a/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
@@ -358,7 +358,7 @@ static const u32 qca953x_1p0_baseband_postamble[][5] = {
         {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
         {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
         {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
-        {0x00009e3c, 0xcfa10820, 0xcfa10820, 0xcfa10822, 0xcfa10822},
+        {0x00009e3c, 0xcfa10820, 0xcfa10820, 0xcfa10820, 0xcfa10820},
         {0x00009e44, 0xfe321e27, 0xfe321e27, 0xfe291e27, 0xfe291e27},
         {0x00009e48, 0x5030201a, 0x5030201a, 0x50302012, 0x50302012},
         {0x00009fc8, 0x0003f000, 0x0003f000, 0x0001a000, 0x0001a000},
@@ -378,7 +378,7 @@ static const u32 qca953x_1p0_baseband_postamble[][5] = {
         {0x0000a284, 0x00000000, 0x00000000, 0x00000010, 0x00000010},
         {0x0000a288, 0x00000110, 0x00000110, 0x00000110, 0x00000110},
         {0x0000a28c, 0x00022222, 0x00022222, 0x00022222, 0x00022222},
-        {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00158d18, 0x00158d18},
+        {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00058d18, 0x00058d18},
         {0x0000a2cc, 0x18c50033, 0x18c43433, 0x18c41033, 0x18c44c33},
         {0x0000a2d0, 0x00041982, 0x00041982, 0x00041982, 0x00041982},
         {0x0000a2d8, 0x7999a83b, 0x7999a83b, 0x7999a83b, 0x7999a83b},
diff --git a/drivers/net/wireless/ath/ath9k/ar955x_1p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar955x_1p0_initvals.h
index fd6a84ccd49e..148562addd38 100644
--- a/drivers/net/wireless/ath/ath9k/ar955x_1p0_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar955x_1p0_initvals.h
@@ -63,7 +63,7 @@ static const u32 ar955x_1p0_baseband_postamble[][5] = {
         {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
         {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
         {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
-        {0x00009e3c, 0xcfa10820, 0xcfa10820, 0xcfa10822, 0xcfa10822},
+        {0x00009e3c, 0xcfa10820, 0xcfa10820, 0xcfa10820, 0xcfa10820},
         {0x00009e44, 0xfe321e27, 0xfe321e27, 0xfe291e27, 0xfe291e27},
         {0x00009e48, 0x5030201a, 0x5030201a, 0x50302012, 0x50302012},
         {0x00009fc8, 0x0003f000, 0x0003f000, 0x0001a000, 0x0001a000},
@@ -83,7 +83,7 @@ static const u32 ar955x_1p0_baseband_postamble[][5] = {
         {0x0000a284, 0x00000000, 0x00000000, 0x00000010, 0x00000010},
         {0x0000a288, 0x00000110, 0x00000110, 0x00000110, 0x00000110},
         {0x0000a28c, 0x00022222, 0x00022222, 0x00022222, 0x00022222},
-        {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00158d18, 0x00158d18},
+        {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00058d18, 0x00058d18},
         {0x0000a2cc, 0x18c50033, 0x18c43433, 0x18c41033, 0x18c44c33},
         {0x0000a2d0, 0x00041982, 0x00041982, 0x00041982, 0x00041982},
         {0x0000a2d8, 0x7999a83b, 0x7999a83b, 0x7999a83b, 0x7999a83b},
diff --git a/drivers/net/wireless/ath/ath9k/ar956x_initvals.h b/drivers/net/wireless/ath/ath9k/ar956x_initvals.h
new file mode 100644
index 000000000000..c3a47eaaf0c0
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/ar956x_initvals.h
@@ -0,0 +1,1046 @@
+/*
+ * Copyright (c) 2010-2011 Atheros Communications Inc.
+ * Copyright (c) 2011-2012 Qualcomm Atheros Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef INITVALS_956X_H
+#define INITVALS_956X_H
+
+#define qca956x_1p0_mac_core ar955x_1p0_mac_core
+
+#define qca956x_1p0_mac_postamble ar9331_1p1_mac_postamble
+
+#define qca956x_1p0_soc_preamble ar955x_1p0_soc_preamble
+
+#define qca956x_1p0_soc_postamble ar9300_2p2_soc_postamble
+
+#define qca956x_1p0_common_wo_xlna_rx_gain_table ar9300Common_wo_xlna_rx_gain_table_2p2
+
+#define qca956x_1p0_baseband_postamble_dfs_channel ar9300_2p2_baseband_postamble_dfs_channel
+
+#define qca956x_1p0_common_wo_xlna_rx_gain_bounds ar955x_1p0_common_wo_xlna_rx_gain_bounds
+
+#define qca956x_1p0_common_rx_gain_bounds ar955x_1p0_common_rx_gain_bounds
+
+#define qca956x_1p0_modes_fast_clock ar9462_2p0_modes_fast_clock
+
+static const u32 qca956x_1p0_baseband_core[][2] = {
+        /* Addr      allmodes  */
+        {0x00009800, 0xafe68e30},
+        {0x00009804, 0xfd14e000},
+        {0x00009808, 0x9c0a9f6b},
+        {0x0000980c, 0x04900000},
+        {0x00009814, 0x0280c00a},
+        {0x00009818, 0x00000000},
+        {0x0000981c, 0x00020028},
+        {0x00009834, 0x6400a190},
+        {0x00009838, 0x0108ecff},
+        {0x0000983c, 0x14000600},
+        {0x00009880, 0x201fff00},
+        {0x00009884, 0x00001042},
+        {0x000098a4, 0x00200400},
+        {0x000098b0, 0x32840cbf},
+        {0x000098bc, 0x00000002},
+        {0x000098d0, 0x004b6a8e},
+        {0x000098d4, 0x00000820},
+        {0x000098dc, 0x00000000},
+        {0x000098f0, 0x00000000},
+        {0x000098f4, 0x00000000},
+        {0x00009c04, 0xff55ff55},
+        {0x00009c08, 0x0320ff55},
+        {0x00009c0c, 0x00000000},
+        {0x00009c10, 0x00000000},
+        {0x00009c14, 0x00046384},
+        {0x00009c18, 0x05b6b440},
+        {0x00009c1c, 0x00b6b440},
+        {0x00009d00, 0xc080a333},
+        {0x00009d04, 0x40206c10},
+        {0x00009d08, 0x009c4060},
+        {0x00009d0c, 0x9883800a},
+        {0x00009d10, 0x01834061},
+        {0x00009d14, 0x00c0040b},
+        {0x00009d18, 0x00000000},
+        {0x00009e08, 0x0038230c},
+        {0x00009e24, 0x990bb514},
+        {0x00009e28, 0x0c6f0000},
+        {0x00009e30, 0x06336f77},
+        {0x00009e34, 0x6af6532f},
+        {0x00009e38, 0x0cc80c00},
+        {0x00009e40, 0x0d261820},
+        {0x00009e4c, 0x00001004},
+        {0x00009e50, 0x00ff03f1},
+        {0x00009fc0, 0x813e4789},
+        {0x00009fc4, 0x0001efb5},
+        {0x00009fcc, 0x40000014},
+        {0x00009fd0, 0x02993b93},
+        {0x0000a20c, 0x00000000},
+        {0x0000a218, 0x00000000},
+        {0x0000a21c, 0x00000000},
+        {0x0000a228, 0x10002310},
+        {0x0000a23c, 0x00000000},
+        {0x0000a244, 0x0c000000},
+        {0x0000a248, 0x00000140},
+        {0x0000a2a0, 0x00000007},
+        {0x0000a2c0, 0x00000007},
+        {0x0000a2c8, 0x00000000},
+        {0x0000a2d4, 0x00000000},
+        {0x0000a2ec, 0x00000000},
+        {0x0000a2f0, 0x00000000},
+        {0x0000a2f4, 0x00000000},
+        {0x0000a2f8, 0x00000000},
+        {0x0000a344, 0x00000000},
+        {0x0000a34c, 0x00000000},
+        {0x0000a350, 0x0000a000},
+        {0x0000a360, 0x00000000},
+        {0x0000a36c, 0x00000000},
+        {0x0000a384, 0x00000001},
+        {0x0000a388, 0x00000444},
+        {0x0000a38c, 0x00000000},
+        {0x0000a390, 0x210d0401},
+        {0x0000a394, 0xab9a7144},
+        {0x0000a398, 0x00000201},
+        {0x0000a39c, 0x42424848},
+        {0x0000a3a0, 0x3c466478},
+        {0x0000a3a4, 0x3a363600},
+        {0x0000a3a8, 0x0000003a},
+        {0x0000a3ac, 0x00000000},
+        {0x0000a3b0, 0x009011fe},
+        {0x0000a3b4, 0x00000034},
+        {0x0000a3b8, 0x00b3ec0a},
+        {0x0000a3bc, 0x00000036},
+        {0x0000a3c0, 0x20202020},
+        {0x0000a3c4, 0x22222220},
+        {0x0000a3c8, 0x20200020},
+        {0x0000a3cc, 0x20202020},
+        {0x0000a3d0, 0x20202020},
+        {0x0000a3d4, 0x20202020},
+        {0x0000a3d8, 0x20202020},
+        {0x0000a3dc, 0x20202020},
+        {0x0000a3e0, 0x20202020},
+        {0x0000a3e4, 0x20202020},
+        {0x0000a3e8, 0x20202020},
+        {0x0000a3ec, 0x20202020},
+        {0x0000a3f0, 0x00000000},
+        {0x0000a3f4, 0x00000000},
+        {0x0000a3f8, 0x0c9bd380},
+        {0x0000a3fc, 0x000f0f01},
+        {0x0000a400, 0x8fa91f01},
+        {0x0000a404, 0x00000000},
+        {0x0000a408, 0x0e79e5c6},
+        {0x0000a40c, 0x00820820},
+        {0x0000a414, 0x1ce739ce},
+        {0x0000a418, 0x2d0019ce},
+        {0x0000a41c, 0x1ce739ce},
+        {0x0000a420, 0x000001ce},
+        {0x0000a424, 0x1ce739ce},
+        {0x0000a428, 0x000001ce},
+        {0x0000a42c, 0x1ce739ce},
+        {0x0000a430, 0x1ce739ce},
+        {0x0000a434, 0x00000000},
+        {0x0000a438, 0x00001801},
+        {0x0000a43c, 0x00100000},
+        {0x0000a444, 0x00000000},
+        {0x0000a448, 0x05000080},
+        {0x0000a44c, 0x00000001},
+        {0x0000a450, 0x00010000},
+        {0x0000a454, 0x05000000},
+        {0x0000a458, 0x00000000},
+        {0x0000a644, 0xbfad9fee},
+        {0x0000a648, 0x0048660d},
+        {0x0000a64c, 0x00003c37},
+        {0x0000a670, 0x03020100},
+        {0x0000a674, 0x21200504},
+        {0x0000a678, 0x61602322},
+        {0x0000a67c, 0x65646362},
+        {0x0000a680, 0x6b6a6968},
+        {0x0000a684, 0xe2706d6c},
+        {0x0000a688, 0x000000e3},
+        {0x0000a690, 0x00000838},
+        {0x0000a7cc, 0x00000000},
+        {0x0000a7d0, 0x00000000},
+        {0x0000a7d4, 0x00000004},
+        {0x0000a7dc, 0x00000000},
+        {0x0000a8d0, 0x004b6a8e},
+        {0x0000a8d4, 0x00000820},
+        {0x0000a8dc, 0x00000000},
+        {0x0000a8f0, 0x00000000},
+        {0x0000a8f4, 0x00000000},
+        {0x0000b2d0, 0x00000080},
+        {0x0000b2d4, 0x00000000},
+        {0x0000b2ec, 0x00000000},
+        {0x0000b2f0, 0x00000000},
+        {0x0000b2f4, 0x00000000},
+        {0x0000b2f8, 0x00000000},
+        {0x0000b408, 0x0e79e5c0},
+        {0x0000b40c, 0x00820820},
+        {0x0000b420, 0x00000000},
+        {0x0000b8d0, 0x004b6a8e},
+        {0x0000b8d4, 0x00000820},
+        {0x0000b8dc, 0x00000000},
+        {0x0000b8f0, 0x00000000},
+        {0x0000b8f4, 0x00000000},
+        {0x0000c2d0, 0x00000080},
+        {0x0000c2d4, 0x00000000},
+        {0x0000c2ec, 0x00000000},
+        {0x0000c2f0, 0x00000000},
+        {0x0000c2f4, 0x00000000},
+        {0x0000c2f8, 0x00000000},
+        {0x0000c408, 0x0e79e5c0},
+        {0x0000c40c, 0x00820820},
+        {0x0000c420, 0x00000000},
+};
+
+static const u32 qca956x_1p0_baseband_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00009810, 0xd00a8005, 0xd00a8005, 0xd00a8011, 0xd00a8011},
+        {0x00009820, 0x206a022e, 0x206a022e, 0x206a01ae, 0x206a01ae},
+        {0x00009824, 0x5ac640d0, 0x5ac640d0, 0x5ac621f1, 0x5ac621f1},
+        {0x00009828, 0x06903081, 0x06903081, 0x07d43881, 0x07d43881},
+        {0x0000982c, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4},
+        {0x00009830, 0x0000059c, 0x0000059c, 0x0000119c, 0x0000119c},
+        {0x00009c00, 0x000000c4, 0x000000c4, 0x000000c4, 0x000000c4},
+        {0x00009e00, 0x0372111a, 0x0372111a, 0x037216a0, 0x037216a0},
+        {0x00009e04, 0x001c2020, 0x001c2020, 0x001c2020, 0x001c2020},
+        {0x00009e0c, 0x6c4000e2, 0x6d4000e2, 0x6d4000de, 0x6c4000de},
+        {0x00009e10, 0x7ec88d2e, 0x7ec88d2e, 0x7ec84d2e, 0x7ec86d2e},
+        {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x337d605e, 0x337d5d5e},
+        {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
+        {0x00009e20, 0x000003b5, 0x000003b5, 0x000003a6, 0x000003a6},
+        {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
+        {0x00009e3c, 0xcfa10820, 0xcfa10820, 0xcf946222, 0xcf946222},
+        {0x00009e44, 0xfe321e27, 0xfe321e27, 0xfe291e27, 0xfe291e27},
+        {0x00009e48, 0x5030201a, 0x5030201a, 0x50302012, 0x50302012},
+        {0x00009fc8, 0x0003f000, 0x0003f000, 0x0001a000, 0x0001a000},
+        {0x0000a204, 0x005c0ec0, 0x005c0ec4, 0x045c0cc4, 0x045c0cc0},
+        {0x0000a208, 0x00000104, 0x00000104, 0x00000004, 0x00000004},
+        {0x0000a22c, 0x07e26a2f, 0x07e26a2f, 0x01026a2f, 0x01026a2f},
+        {0x0000a230, 0x0000400a, 0x00004014, 0x00004016, 0x0000400b},
+        {0x0000a234, 0x00000fff, 0x10000fff, 0x10000fff, 0x00000fff},
+        {0x0000a238, 0xffb01018, 0xffb01018, 0xffb01018, 0xffb01018},
+        {0x0000a250, 0x00000000, 0x00000000, 0x00000210, 0x00000108},
+        {0x0000a254, 0x000007d0, 0x00000fa0, 0x00001130, 0x00000898},
+        {0x0000a258, 0x02020002, 0x02020002, 0x02020002, 0x02020002},
+        {0x0000a25c, 0x01000e0e, 0x01000e0e, 0x01010e0e, 0x01010e0e},
+        {0x0000a260, 0x0a021501, 0x0a021501, 0x3a021501, 0x3a021501},
+        {0x0000a264, 0x00000e0e, 0x00000e0e, 0x01000e0e, 0x01000e0e},
+        {0x0000a280, 0x00000007, 0x00000007, 0x0000000b, 0x0000000b},
+        {0x0000a284, 0x00000000, 0x00000000, 0x00000010, 0x00000010},
+        {0x0000a288, 0x00000110, 0x00000110, 0x00000110, 0x00000110},
+        {0x0000a28c, 0x00022222, 0x00022222, 0x00022222, 0x00022222},
+        {0x0000a2c4, 0x00058d18, 0x00058d18, 0x00058d18, 0x00058d18},
+        {0x0000a2cc, 0x18c50033, 0x18c43433, 0x18c41033, 0x18c44c33},
+        {0x0000a2d0, 0x00041982, 0x00041982, 0x00041982, 0x00041982},
+        {0x0000a2d8, 0x7999a83b, 0x7999a83b, 0x7999a83b, 0x7999a83b},
+        {0x0000a358, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a830, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000ae04, 0x001c0000, 0x001c0000, 0x001c0000, 0x001c0000},
+        {0x0000ae18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000ae1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000ae20, 0x000001b5, 0x000001b5, 0x000001a6, 0x000001a6},
+        {0x0000b284, 0x00000000, 0x00000000, 0x00000010, 0x00000010},
+        {0x0000b830, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000be04, 0x001c0000, 0x001c0000, 0x001c0000, 0x001c0000},
+        {0x0000be18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000be1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000be20, 0x000001b5, 0x000001b5, 0x000001a6, 0x000001a6},
+        {0x0000c284, 0x00000000, 0x00000000, 0x00000010, 0x00000010},
+};
+
+static const u32 qca956x_1p0_radio_core[][2] = {
+        /* Addr      allmodes  */
+        {0x00016000, 0x36db6db6},
+        {0x00016004, 0x6db6db40},
+        {0x00016008, 0x73f00000},
+        {0x0001600c, 0x00000000},
+        {0x00016040, 0x3f80fff8},
+        {0x0001604c, 0x000f0278},
+        {0x00016050, 0x8036db6c},
+        {0x00016054, 0x6db60000},
+        {0x00016080, 0x00080000},
+        {0x00016084, 0x0e48048c},
+        {0x00016088, 0x14214514},
+        {0x0001608c, 0x119f080a},
+        {0x00016090, 0x24926490},
+        {0x00016094, 0x00000000},
+        {0x000160a0, 0xc2108ffe},
+        {0x000160a4, 0x812fc370},
+        {0x000160a8, 0x423c8000},
+        {0x000160b4, 0x92480000},
+        {0x000160c0, 0x006db6d8},
+        {0x000160c4, 0x24b6db6c},
+        {0x000160c8, 0x6db6db6c},
+        {0x000160cc, 0x6db6fb7c},
+        {0x000160d0, 0x6db6da44},
+        {0x00016100, 0x07ff8001},
+        {0x00016108, 0x00080010},
+        {0x00016144, 0x01884080},
+        {0x00016148, 0x00008058},
+        {0x00016288, 0x001c6000},
+        {0x0001628c, 0x50000000},
+        {0x000162c0, 0x4b962100},
+        {0x000162c4, 0x00000480},
+        {0x000162c8, 0x04000144},
+        {0x00016380, 0x00000000},
+        {0x00016384, 0x00000000},
+        {0x00016388, 0x00800700},
+        {0x0001638c, 0x00800700},
+        {0x00016390, 0x00800700},
+        {0x00016394, 0x00000000},
+        {0x00016398, 0x00000000},
+        {0x0001639c, 0x00000000},
+        {0x000163a0, 0x00000001},
+        {0x000163a4, 0x00000001},
+        {0x000163a8, 0x00000000},
+        {0x000163ac, 0x00000000},
+        {0x000163b0, 0x00000000},
+        {0x000163b4, 0x00000000},
+        {0x000163b8, 0x00000000},
+        {0x000163bc, 0x00000000},
+        {0x000163c0, 0x000000a0},
+        {0x000163c4, 0x000c0000},
+        {0x000163c8, 0x14021402},
+        {0x000163cc, 0x00001402},
+        {0x000163d0, 0x00000000},
+        {0x000163d4, 0x00000000},
+        {0x00016400, 0x36db6db6},
+        {0x00016404, 0x6db6db40},
+        {0x00016408, 0x73f00000},
+        {0x0001640c, 0x00000000},
+        {0x00016440, 0x3f80fff8},
+        {0x0001644c, 0x000f0278},
+        {0x00016450, 0x8036db6c},
+        {0x00016454, 0x6db60000},
+        {0x00016500, 0x07ff8001},
+        {0x00016508, 0x00080010},
+        {0x00016544, 0x01884080},
+        {0x00016548, 0x00008058},
+        {0x00016780, 0x00000000},
+        {0x00016784, 0x00000000},
+        {0x00016788, 0x00800700},
+        {0x0001678c, 0x00800700},
+        {0x00016790, 0x00800700},
+        {0x00016794, 0x00000000},
+        {0x00016798, 0x00000000},
+        {0x0001679c, 0x00000000},
+        {0x000167a0, 0x00000001},
+        {0x000167a4, 0x00000001},
+        {0x000167a8, 0x00000000},
+        {0x000167ac, 0x00000000},
+        {0x000167b0, 0x00000000},
+        {0x000167b4, 0x00000000},
+        {0x000167b8, 0x00000000},
+        {0x000167bc, 0x00000000},
+        {0x000167c0, 0x000000a0},
+        {0x000167c4, 0x000c0000},
+        {0x000167c8, 0x14021402},
+        {0x000167cc, 0x00001402},
+        {0x000167d0, 0x00000000},
+        {0x000167d4, 0x00000000},
+        {0x00016800, 0x36db6db6},
+        {0x00016804, 0x6db6db40},
+        {0x00016808, 0x73f00000},
+        {0x0001680c, 0x00000000},
+        {0x00016840, 0x3f80fff8},
+        {0x0001684c, 0x000f0278},
+        {0x00016850, 0x8036db6c},
+        {0x00016854, 0x6db60000},
+        {0x00016900, 0x07ff8001},
+        {0x00016908, 0x00080010},
+        {0x00016944, 0x01884080},
+        {0x00016948, 0x00008058},
+        {0x00016b80, 0x00000000},
+        {0x00016b84, 0x00000000},
+        {0x00016b88, 0x00800700},
+        {0x00016b8c, 0x00800700},
+        {0x00016b90, 0x00800700},
+        {0x00016b94, 0x00000000},
+        {0x00016b98, 0x00000000},
+        {0x00016b9c, 0x00000000},
+        {0x00016ba0, 0x00000001},
+        {0x00016ba4, 0x00000001},
+        {0x00016ba8, 0x00000000},
+        {0x00016bac, 0x00000000},
+        {0x00016bb0, 0x00000000},
+        {0x00016bb4, 0x00000000},
+        {0x00016bb8, 0x00000000},
+        {0x00016bbc, 0x00000000},
+        {0x00016bc0, 0x000000a0},
+        {0x00016bc4, 0x000c0000},
+        {0x00016bc8, 0x14021402},
+        {0x00016bcc, 0x00001402},
+        {0x00016bd0, 0x00000000},
+        {0x00016bd4, 0x00000000},
+};
+
+static const u32 qca956x_1p0_radio_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00016098, 0xd2dd5554, 0xd2dd5554, 0xc4128f5c, 0xc4128f5c},
+        {0x0001609c, 0x0a566f3a, 0x0a566f3a, 0x0fd08f25, 0x0fd08f25},
+        {0x000160ac, 0xa4647c00, 0xa4647c00, 0x24646800, 0x24646800},
+        {0x000160b0, 0x01885f52, 0x01885f52, 0x00fe7f46, 0x00fe7f46},
+        {0x00016104, 0xb7a00000, 0xb7a00000, 0xfff80001, 0xfff80001},
+        {0x0001610c, 0xc0000000, 0xc0000000, 0x00000000, 0x00000000},
+        {0x00016140, 0x10804008, 0x10804008, 0x50804000, 0x50804000},
+        {0x00016504, 0xb7a00000, 0xb7a00000, 0xfff80001, 0xfff80001},
+        {0x0001650c, 0xc0000000, 0xc0000000, 0x00000000, 0x00000000},
+        {0x00016540, 0x10804008, 0x10804008, 0x50804000, 0x50804000},
+        {0x00016904, 0xb7a00000, 0xb7a00000, 0xfff80001, 0xfff80001},
+        {0x0001690c, 0xc0000000, 0xc0000000, 0x00000000, 0x00000000},
+        {0x00016940, 0x10804008, 0x10804008, 0x50804000, 0x50804000},
+};
+
+static const u32 qca956x_1p0_baseband_core_txfir_coeff_japan_2484[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a38c, 0x00000000},
+        {0x0000a390, 0x6f7f0301},
+        {0x0000a394, 0xca9228ee},
+};
+
+static const u32 qca956x_1p0_modes_no_xpa_tx_gain_table[][3] = {
+        /* Addr      5G          2G        */
+        {0x0000a2dc, 0xffa9ac94, 0xffa9ac94},
+        {0x0000a2e0, 0xff323118, 0xff323118},
+        {0x0000a2e4, 0xff3ffe00, 0xff3ffe00},
+        {0x0000a2e8, 0xffc00000, 0xffc00000},
+        {0x0000a39c, 0x42424242, 0x42424242},
+        {0x0000a3a4, 0x3a3e3e00, 0x3a3e3e00},
+        {0x0000a3b0, 0x00a01404, 0x00a01404},
+        {0x0000a3b4, 0x00000034, 0x00000034},
+        {0x0000a3b8, 0x00800408, 0x00800408},
+        {0x0000a3bc, 0x00000036, 0x00000036},
+        {0x0000a410, 0x000050dc, 0x000050dc},
+        {0x0000a500, 0x09000040, 0x09000040},
+        {0x0000a504, 0x0b000041, 0x0b000041},
+        {0x0000a508, 0x0d000042, 0x0d000042},
+        {0x0000a50c, 0x11000044, 0x11000044},
+        {0x0000a510, 0x15000046, 0x15000046},
+        {0x0000a514, 0x1d000440, 0x1d000440},
+        {0x0000a518, 0x1f000441, 0x1f000441},
+        {0x0000a51c, 0x23000443, 0x23000443},
+        {0x0000a520, 0x25000444, 0x25000444},
+        {0x0000a524, 0x280004e0, 0x280004e0},
+        {0x0000a528, 0x2c0004e2, 0x2c0004e2},
+        {0x0000a52c, 0x2e0004e3, 0x2e0004e3},
+        {0x0000a530, 0x300004e4, 0x300004e4},
+        {0x0000a534, 0x340004e6, 0x340004e6},
+        {0x0000a538, 0x37000ce0, 0x37000ce0},
+        {0x0000a53c, 0x3b000ce2, 0x3b000ce2},
+        {0x0000a540, 0x3d000ce3, 0x3d000ce3},
+        {0x0000a544, 0x3f000ce4, 0x3f000ce4},
+        {0x0000a548, 0x45001ee0, 0x45001ee0},
+        {0x0000a54c, 0x49001ee2, 0x49001ee2},
+        {0x0000a550, 0x4d001ee4, 0x4d001ee4},
+        {0x0000a554, 0x51001ee6, 0x51001ee6},
+        {0x0000a558, 0x55001eea, 0x55001eea},
+        {0x0000a55c, 0x59001eec, 0x59001eec},
+        {0x0000a560, 0x5d001ef0, 0x5d001ef0},
+        {0x0000a564, 0x5f001ef1, 0x5f001ef1},
+        {0x0000a568, 0x60001ef2, 0x60001ef2},
+        {0x0000a56c, 0x61001ef3, 0x61001ef3},
+        {0x0000a570, 0x62001ef4, 0x62001ef4},
+        {0x0000a574, 0x63001ef5, 0x63001ef5},
+        {0x0000a578, 0x64001ffc, 0x64001ffc},
+        {0x0000a57c, 0x64001ffc, 0x64001ffc},
+        {0x0000a600, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00804000, 0x00804000},
+        {0x0000a614, 0x00804201, 0x00804201},
+        {0x0000a618, 0x00804201, 0x00804201},
+        {0x0000a61c, 0x00804201, 0x00804201},
+        {0x0000a620, 0x00804201, 0x00804201},
+        {0x0000a624, 0x00804201, 0x00804201},
+        {0x0000a628, 0x00804201, 0x00804201},
+        {0x0000a62c, 0x02808a02, 0x02808a02},
+        {0x0000a630, 0x0340cd03, 0x0340cd03},
+        {0x0000a634, 0x0340cd03, 0x0340cd03},
+        {0x0000a638, 0x0340cd03, 0x0340cd03},
+        {0x0000a63c, 0x05011404, 0x05011404},
+        {0x0000b2dc, 0xffa9ac94, 0xffa9ac94},
+        {0x0000b2e0, 0xff323118, 0xff323118},
+        {0x0000b2e4, 0xff3ffe00, 0xff3ffe00},
+        {0x0000b2e8, 0xffc00000, 0xffc00000},
+        {0x0000c2dc, 0xffa9ac94, 0xffa9ac94},
+        {0x0000c2e0, 0xff323118, 0xff323118},
+        {0x0000c2e4, 0xff3ffe00, 0xff3ffe00},
+        {0x0000c2e8, 0xffc00000, 0xffc00000},
+        {0x00016044, 0x049242db, 0x049242db},
+        {0x00016048, 0x64925a70, 0x64925a70},
+        {0x00016148, 0x00008050, 0x00008050},
+        {0x00016280, 0x41110005, 0x41110005},
+        {0x00016284, 0x453a6000, 0x453a6000},
+        {0x00016444, 0x049242db, 0x049242db},
+        {0x00016448, 0x6c925a70, 0x6c925a70},
+        {0x00016548, 0x00008050, 0x00008050},
+        {0x00016844, 0x049242db, 0x049242db},
+        {0x00016848, 0x6c925a70, 0x6c925a70},
+        {0x00016948, 0x00008050, 0x00008050},
+};
+
+static const u32 qca956x_1p0_modes_xpa_tx_gain_table[][3] = {
+        /* Addr      5G          2G        */
+        {0x0000a2dc, 0xcc69ac94, 0xcc69ac94},
+        {0x0000a2e0, 0xf0b23118, 0xf0b23118},
+        {0x0000a2e4, 0xffffc000, 0xffffc000},
+        {0x0000a2e8, 0xc0000000, 0xc0000000},
+        {0x0000a410, 0x000050d2, 0x000050d2},
+        {0x0000a500, 0x0a000040, 0x0a000040},
+        {0x0000a504, 0x0c000041, 0x0c000041},
+        {0x0000a508, 0x0e000042, 0x0e000042},
+        {0x0000a50c, 0x12000044, 0x12000044},
+        {0x0000a510, 0x16000046, 0x16000046},
+        {0x0000a514, 0x1d000440, 0x1d000440},
+        {0x0000a518, 0x1f000441, 0x1f000441},
+        {0x0000a51c, 0x23000443, 0x23000443},
+        {0x0000a520, 0x25000444, 0x25000444},
+        {0x0000a524, 0x29000a40, 0x29000a40},
+        {0x0000a528, 0x2d000a42, 0x2d000a42},
+        {0x0000a52c, 0x2f000a43, 0x2f000a43},
+        {0x0000a530, 0x31000a44, 0x31000a44},
+        {0x0000a534, 0x35000a46, 0x35000a46},
+        {0x0000a538, 0x38000ce0, 0x38000ce0},
+        {0x0000a53c, 0x3c000ce2, 0x3c000ce2},
+        {0x0000a540, 0x3e000ce3, 0x3e000ce3},
+        {0x0000a544, 0x40000ce4, 0x40000ce4},
+        {0x0000a548, 0x46001ee0, 0x46001ee0},
+        {0x0000a54c, 0x4a001ee2, 0x4a001ee2},
+        {0x0000a550, 0x4e001ee4, 0x4e001ee4},
+        {0x0000a554, 0x52001ee6, 0x52001ee6},
+        {0x0000a558, 0x56001eea, 0x56001eea},
+        {0x0000a55c, 0x5a001eec, 0x5a001eec},
+        {0x0000a560, 0x5e001ef0, 0x5e001ef0},
+        {0x0000a564, 0x60001ef1, 0x60001ef1},
+        {0x0000a568, 0x61001ef2, 0x61001ef2},
+        {0x0000a56c, 0x62001ef3, 0x62001ef3},
+        {0x0000a570, 0x63001ef4, 0x63001ef4},
+        {0x0000a574, 0x64001ef5, 0x64001ef5},
+        {0x0000a578, 0x65001ffc, 0x65001ffc},
+        {0x0000a57c, 0x65001ffc, 0x65001ffc},
+        {0x0000a600, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00000000, 0x00000000},
+        {0x0000a614, 0x00000000, 0x00000000},
+        {0x0000a618, 0x00000000, 0x00000000},
+        {0x0000a61c, 0x00804201, 0x00804201},
+        {0x0000a620, 0x00804201, 0x00804201},
+        {0x0000a624, 0x00804201, 0x00804201},
+        {0x0000a628, 0x00804201, 0x00804201},
+        {0x0000a62c, 0x02808a02, 0x02808a02},
+        {0x0000a630, 0x0340cd03, 0x0340cd03},
+        {0x0000a634, 0x0340cd03, 0x0340cd03},
+        {0x0000a638, 0x0340cd03, 0x0340cd03},
+        {0x0000a63c, 0x05011404, 0x05011404},
+        {0x0000b2dc, 0xcc69ac94, 0xcc69ac94},
+        {0x0000b2e0, 0xf0b23118, 0xf0b23118},
+        {0x0000b2e4, 0xffffc000, 0xffffc000},
+        {0x0000b2e8, 0xc0000000, 0xc0000000},
+        {0x0000c2dc, 0xcc69ac94, 0xcc69ac94},
+        {0x0000c2e0, 0xf0b23118, 0xf0b23118},
+        {0x0000c2e4, 0xffffc000, 0xffffc000},
+        {0x0000c2e8, 0xc0000000, 0xc0000000},
+        {0x00016044, 0x012492db, 0x012492db},
+        {0x00016048, 0x6c927a70, 0x6c927a70},
+        {0x00016050, 0x8036d36c, 0x8036d36c},
+        {0x00016280, 0x41110005, 0x41110005},
+        {0x00016284, 0x453a7e00, 0x453a7e00},
+        {0x00016444, 0x012492db, 0x012492db},
+        {0x00016448, 0x6c927a70, 0x6c927a70},
+        {0x00016450, 0x8036d36c, 0x8036d36c},
+        {0x00016844, 0x012492db, 0x012492db},
+        {0x00016848, 0x6c927a70, 0x6c927a70},
+        {0x00016850, 0x8036d36c, 0x8036d36c},
+};
+
+static const u32 qca956x_1p0_modes_no_xpa_low_ob_db_tx_gain_table[][3] = {
+        /* Addr      5G          2G        */
+        {0x0000a2dc, 0xffa9ac94, 0xffa9ac94},
+        {0x0000a2e0, 0xff323118, 0xff323118},
+        {0x0000a2e4, 0xff3ffe00, 0xff3ffe00},
+        {0x0000a2e8, 0xffc00000, 0xffc00000},
+        {0x0000a39c, 0x42424242, 0x42424242},
+        {0x0000a3a4, 0x3a3e3e00, 0x3a3e3e00},
+        {0x0000a3b0, 0x00a01404, 0x00a01404},
+        {0x0000a3b4, 0x00000034, 0x00000034},
+        {0x0000a3b8, 0x00800408, 0x00800408},
+        {0x0000a3bc, 0x00000036, 0x00000036},
+        {0x0000a410, 0x000050dc, 0x000050dc},
+        {0x0000a414, 0x16b739ce, 0x16b739ce},
+        {0x0000a418, 0x2d00198b, 0x2d00198b},
+        {0x0000a41c, 0x16b5adce, 0x16b5adce},
+        {0x0000a420, 0x0000014a, 0x0000014a},
+        {0x0000a424, 0x14a525cc, 0x14a525cc},
+        {0x0000a428, 0x0000012a, 0x0000012a},
+        {0x0000a42c, 0x14a5294a, 0x14a5294a},
+        {0x0000a430, 0x1294a929, 0x1294a929},
+        {0x0000a500, 0x09000040, 0x09000040},
+        {0x0000a504, 0x0b000041, 0x0b000041},
+        {0x0000a508, 0x0d000042, 0x0d000042},
+        {0x0000a50c, 0x11000044, 0x11000044},
+        {0x0000a510, 0x15000046, 0x15000046},
+        {0x0000a514, 0x1d000440, 0x1d000440},
+        {0x0000a518, 0x1f000441, 0x1f000441},
+        {0x0000a51c, 0x23000443, 0x23000443},
+        {0x0000a520, 0x25000444, 0x25000444},
+        {0x0000a524, 0x280004e0, 0x280004e0},
+        {0x0000a528, 0x2c0004e2, 0x2c0004e2},
+        {0x0000a52c, 0x2e0004e3, 0x2e0004e3},
+        {0x0000a530, 0x300004e4, 0x300004e4},
+        {0x0000a534, 0x340004e6, 0x340004e6},
+        {0x0000a538, 0x37000ce0, 0x37000ce0},
+        {0x0000a53c, 0x3b000ce2, 0x3b000ce2},
+        {0x0000a540, 0x3d000ce3, 0x3d000ce3},
+        {0x0000a544, 0x3f000ce4, 0x3f000ce4},
+        {0x0000a548, 0x45001ee0, 0x45001ee0},
+        {0x0000a54c, 0x49001ee2, 0x49001ee2},
+        {0x0000a550, 0x4d001ee4, 0x4d001ee4},
+        {0x0000a554, 0x51001ee6, 0x51001ee6},
+        {0x0000a558, 0x55001eea, 0x55001eea},
+        {0x0000a55c, 0x59001eec, 0x59001eec},
+        {0x0000a560, 0x5d001ef0, 0x5d001ef0},
+        {0x0000a564, 0x5f001ef1, 0x5f001ef1},
+        {0x0000a568, 0x60001ef2, 0x60001ef2},
+        {0x0000a56c, 0x61001ef3, 0x61001ef3},
+        {0x0000a570, 0x62001ef4, 0x62001ef4},
+        {0x0000a574, 0x63001ef5, 0x63001ef5},
+        {0x0000a578, 0x64001ffc, 0x64001ffc},
+        {0x0000a57c, 0x64001ffc, 0x64001ffc},
+        {0x0000a600, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00804000, 0x00804000},
+        {0x0000a614, 0x00804201, 0x00804201},
+        {0x0000a618, 0x00804201, 0x00804201},
+        {0x0000a61c, 0x00804201, 0x00804201},
+        {0x0000a620, 0x00804201, 0x00804201},
+        {0x0000a624, 0x00804201, 0x00804201},
+        {0x0000a628, 0x00804201, 0x00804201},
+        {0x0000a62c, 0x02808a02, 0x02808a02},
+        {0x0000a630, 0x0340cd03, 0x0340cd03},
+        {0x0000a634, 0x0340cd03, 0x0340cd03},
+        {0x0000a638, 0x0340cd03, 0x0340cd03},
+        {0x0000a63c, 0x05011404, 0x05011404},
+        {0x0000b2dc, 0xffa9ac94, 0xffa9ac94},
+        {0x0000b2e0, 0xff323118, 0xff323118},
+        {0x0000b2e4, 0xff3ffe00, 0xff3ffe00},
+        {0x0000b2e8, 0xffc00000, 0xffc00000},
+        {0x0000c2dc, 0xffa9ac94, 0xffa9ac94},
+        {0x0000c2e0, 0xff323118, 0xff323118},
+        {0x0000c2e4, 0xff3ffe00, 0xff3ffe00},
+        {0x0000c2e8, 0xffc00000, 0xffc00000},
+        {0x00016044, 0x046e42db, 0x046e42db},
+        {0x00016048, 0x64925a70, 0x64925a70},
+        {0x00016148, 0x00008050, 0x00008050},
+        {0x00016280, 0x41110005, 0x41110005},
+        {0x00016284, 0x453a6000, 0x453a6000},
+        {0x00016444, 0x046e42db, 0x046e42db},
+        {0x00016448, 0x6c925a70, 0x6c925a70},
+        {0x00016548, 0x00008050, 0x00008050},
+        {0x00016844, 0x046e42db, 0x046e42db},
+        {0x00016848, 0x6c925a70, 0x6c925a70},
+        {0x00016948, 0x00008050, 0x00008050},
+};
+
+static const u32 qca956x_1p0_modes_no_xpa_green_tx_gain_table[][3] = {
+        /* Addr      5G          2G        */
+        {0x000098bc, 0x00000001, 0x00000001},
+        {0x0000a2dc, 0xd3555284, 0xd3555284},
+        {0x0000a2e0, 0x1c666318, 0x1c666318},
+        {0x0000a2e4, 0xe07bbc00, 0xe07bbc00},
+        {0x0000a2e8, 0xff800000, 0xff800000},
+        {0x0000a3a4, 0x3a3e3e00, 0x3a3e3e00},
+        {0x0000a410, 0x000050dc, 0x000050dc},
+        {0x0000a500, 0x02000040, 0x02000040},
+        {0x0000a504, 0x04000041, 0x04000041},
+        {0x0000a508, 0x06000042, 0x06000042},
+        {0x0000a50c, 0x0a000044, 0x0a000044},
+        {0x0000a510, 0x0c000045, 0x0c000045},
+        {0x0000a514, 0x13000440, 0x13000440},
+        {0x0000a518, 0x15000441, 0x15000441},
+        {0x0000a51c, 0x19000443, 0x19000443},
+        {0x0000a520, 0x1b000444, 0x1b000444},
+        {0x0000a524, 0x1e0004e0, 0x1e0004e0},
+        {0x0000a528, 0x220004e2, 0x220004e2},
+        {0x0000a52c, 0x240004e3, 0x240004e3},
+        {0x0000a530, 0x260004e4, 0x260004e4},
+        {0x0000a534, 0x2a0004e6, 0x2a0004e6},
+        {0x0000a538, 0x32000ce0, 0x32000ce0},
+        {0x0000a53c, 0x36000ce2, 0x36000ce2},
+        {0x0000a540, 0x3a000ce4, 0x3a000ce4},
+        {0x0000a544, 0x3e000ce6, 0x3e000ce6},
+        {0x0000a548, 0x45001ee0, 0x45001ee0},
+        {0x0000a54c, 0x49001ee2, 0x49001ee2},
+        {0x0000a550, 0x4d001ee4, 0x4d001ee4},
+        {0x0000a554, 0x51001ee6, 0x51001ee6},
+        {0x0000a558, 0x55001eea, 0x55001eea},
+        {0x0000a55c, 0x59001eec, 0x59001eec},
+        {0x0000a560, 0x5d001ef0, 0x5d001ef0},
+        {0x0000a564, 0x5f001ef1, 0x5f001ef1},
+        {0x0000a568, 0x60001ef2, 0x60001ef2},
+        {0x0000a56c, 0x61001ef3, 0x61001ef3},
+        {0x0000a570, 0x62001ef4, 0x62001ef4},
+        {0x0000a574, 0x63001ff5, 0x63001ff5},
+        {0x0000a578, 0x64001ffc, 0x64001ffc},
+        {0x0000a57c, 0x64001ffc, 0x64001ffc},
+        {0x0000a600, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00804000, 0x00804000},
+        {0x0000a614, 0x00804201, 0x00804201},
+        {0x0000a618, 0x00804201, 0x00804201},
+        {0x0000a61c, 0x00804201, 0x00804201},
+        {0x0000a620, 0x00804201, 0x00804201},
+        {0x0000a624, 0x00804201, 0x00804201},
+        {0x0000a628, 0x00804201, 0x00804201},
+        {0x0000a62c, 0x02808a02, 0x02808a02},
+        {0x0000a630, 0x0340cd03, 0x0340cd03},
+        {0x0000a634, 0x0340cd03, 0x0340cd03},
+        {0x0000a638, 0x0340cd03, 0x0340cd03},
+        {0x0000a63c, 0x05011404, 0x05011404},
+        {0x0000b2dc, 0xd3555284, 0xd3555284},
+        {0x0000b2e0, 0x1c666318, 0x1c666318},
+        {0x0000b2e4, 0xe07bbc00, 0xe07bbc00},
+        {0x0000b2e8, 0xff800000, 0xff800000},
+        {0x0000c2dc, 0xd3555284, 0xd3555284},
+        {0x0000c2e0, 0x1c666318, 0x1c666318},
+        {0x0000c2e4, 0xe07bbc00, 0xe07bbc00},
+        {0x0000c2e8, 0xff800000, 0xff800000},
+        {0x00016044, 0x849242db, 0x849242db},
+        {0x00016048, 0x64925a70, 0x64925a70},
+        {0x00016280, 0x41110005, 0x41110005},
+        {0x00016284, 0x453a6000, 0x453a6000},
+        {0x00016444, 0x849242db, 0x849242db},
+        {0x00016448, 0x6c925a70, 0x6c925a70},
+        {0x00016844, 0x849242db, 0x849242db},
+        {0x00016848, 0x6c925a70, 0x6c925a70},
+        {0x0000a7f0, 0x800002cc, 0x800002cc},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000028, 0x00000028},
+        {0x0000a7f4, 0x00000028, 0x00000028},
+        {0x0000a7f4, 0x00000028, 0x00000028},
+        {0x0000a7f4, 0x00000028, 0x00000028},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+};
+
+static const u32 qca956x_1p0_common_rx_gain_table[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a000, 0x00010000},
+        {0x0000a004, 0x00030002},
+        {0x0000a008, 0x00050004},
+        {0x0000a00c, 0x00810080},
+        {0x0000a010, 0x00830082},
+        {0x0000a014, 0x01810180},
+        {0x0000a018, 0x01830182},
+        {0x0000a01c, 0x01850184},
+        {0x0000a020, 0x01890188},
+        {0x0000a024, 0x018b018a},
+        {0x0000a028, 0x018d018c},
+        {0x0000a02c, 0x01910190},
+        {0x0000a030, 0x01930192},
+        {0x0000a034, 0x01950194},
+        {0x0000a038, 0x038a0196},
+        {0x0000a03c, 0x038c038b},
+        {0x0000a040, 0x0390038d},
+        {0x0000a044, 0x03920391},
+        {0x0000a048, 0x03940393},
+        {0x0000a04c, 0x03960395},
+        {0x0000a050, 0x00000000},
+        {0x0000a054, 0x00000000},
+        {0x0000a058, 0x00000000},
+        {0x0000a05c, 0x00000000},
+        {0x0000a060, 0x00000000},
+        {0x0000a064, 0x00000000},
+        {0x0000a068, 0x00000000},
+        {0x0000a06c, 0x00000000},
+        {0x0000a070, 0x00000000},
+        {0x0000a074, 0x00000000},
+        {0x0000a078, 0x00000000},
+        {0x0000a07c, 0x00000000},
+        {0x0000a080, 0x22222222},
+        {0x0000a084, 0x1d1d1d1d},
+        {0x0000a088, 0x1d1d1d1d},
+        {0x0000a08c, 0x1d1d1d1d},
+        {0x0000a090, 0x17171717},
+        {0x0000a094, 0x11111717},
+        {0x0000a098, 0x00030311},
+        {0x0000a09c, 0x00000000},
+        {0x0000a0a0, 0x00000000},
+        {0x0000a0a4, 0x00000000},
+        {0x0000a0a8, 0x00000000},
+        {0x0000a0ac, 0x00000000},
+        {0x0000a0b0, 0x00000000},
+        {0x0000a0b4, 0x00000000},
+        {0x0000a0b8, 0x00000000},
+        {0x0000a0bc, 0x00000000},
+        {0x0000a0c0, 0x001f0000},
+        {0x0000a0c4, 0x01000101},
+        {0x0000a0c8, 0x011e011f},
+        {0x0000a0cc, 0x011c011d},
+        {0x0000a0d0, 0x02030204},
+        {0x0000a0d4, 0x02010202},
+        {0x0000a0d8, 0x021f0200},
+        {0x0000a0dc, 0x0302021e},
+        {0x0000a0e0, 0x03000301},
+        {0x0000a0e4, 0x031e031f},
+        {0x0000a0e8, 0x0402031d},
+        {0x0000a0ec, 0x04000401},
+        {0x0000a0f0, 0x041e041f},
+        {0x0000a0f4, 0x0502041d},
+        {0x0000a0f8, 0x05000501},
+        {0x0000a0fc, 0x051e051f},
+        {0x0000a100, 0x06010602},
+        {0x0000a104, 0x061f0600},
+        {0x0000a108, 0x061d061e},
+        {0x0000a10c, 0x07020703},
+        {0x0000a110, 0x07000701},
+        {0x0000a114, 0x00000000},
+        {0x0000a118, 0x00000000},
+        {0x0000a11c, 0x00000000},
+        {0x0000a120, 0x00000000},
+        {0x0000a124, 0x00000000},
+        {0x0000a128, 0x00000000},
+        {0x0000a12c, 0x00000000},
+        {0x0000a130, 0x00000000},
+        {0x0000a134, 0x00000000},
+        {0x0000a138, 0x00000000},
+        {0x0000a13c, 0x00000000},
+        {0x0000a140, 0x001f0000},
+        {0x0000a144, 0x01000101},
+        {0x0000a148, 0x011e011f},
+        {0x0000a14c, 0x011c011d},
+        {0x0000a150, 0x02030204},
+        {0x0000a154, 0x02010202},
+        {0x0000a158, 0x021f0200},
+        {0x0000a15c, 0x0302021e},
+        {0x0000a160, 0x03000301},
+        {0x0000a164, 0x031e031f},
+        {0x0000a168, 0x0402031d},
+        {0x0000a16c, 0x04000401},
+        {0x0000a170, 0x041e041f},
+        {0x0000a174, 0x0502041d},
+        {0x0000a178, 0x05000501},
+        {0x0000a17c, 0x051e051f},
+        {0x0000a180, 0x06010602},
+        {0x0000a184, 0x061f0600},
+        {0x0000a188, 0x061d061e},
+        {0x0000a18c, 0x07020703},
+        {0x0000a190, 0x07000701},
+        {0x0000a194, 0x00000000},
+        {0x0000a198, 0x00000000},
+        {0x0000a19c, 0x00000000},
+        {0x0000a1a0, 0x00000000},
+        {0x0000a1a4, 0x00000000},
+        {0x0000a1a8, 0x00000000},
+        {0x0000a1ac, 0x00000000},
+        {0x0000a1b0, 0x00000000},
+        {0x0000a1b4, 0x00000000},
+        {0x0000a1b8, 0x00000000},
+        {0x0000a1bc, 0x00000000},
+        {0x0000a1c0, 0x00000000},
+        {0x0000a1c4, 0x00000000},
+        {0x0000a1c8, 0x00000000},
+        {0x0000a1cc, 0x00000000},
+        {0x0000a1d0, 0x00000000},
+        {0x0000a1d4, 0x00000000},
+        {0x0000a1d8, 0x00000000},
+        {0x0000a1dc, 0x00000000},
+        {0x0000a1e0, 0x00000000},
+        {0x0000a1e4, 0x00000000},
+        {0x0000a1e8, 0x00000000},
+        {0x0000a1ec, 0x00000000},
+        {0x0000a1f0, 0x00000396},
+        {0x0000a1f4, 0x00000396},
+        {0x0000a1f8, 0x00000396},
+        {0x0000a1fc, 0x00000196},
+        {0x0000b000, 0x00010000},
+        {0x0000b004, 0x00030002},
+        {0x0000b008, 0x00050004},
+        {0x0000b00c, 0x00810080},
+        {0x0000b010, 0x00830082},
+        {0x0000b014, 0x01810180},
+        {0x0000b018, 0x01830182},
+        {0x0000b01c, 0x01850184},
+        {0x0000b020, 0x02810280},
+        {0x0000b024, 0x02830282},
+        {0x0000b028, 0x02850284},
+        {0x0000b02c, 0x02890288},
+        {0x0000b030, 0x028b028a},
+        {0x0000b034, 0x0388028c},
+        {0x0000b038, 0x038a0389},
+        {0x0000b03c, 0x038c038b},
+        {0x0000b040, 0x0390038d},
+        {0x0000b044, 0x03920391},
+        {0x0000b048, 0x03940393},
+        {0x0000b04c, 0x03960395},
+        {0x0000b050, 0x00000000},
+        {0x0000b054, 0x00000000},
+        {0x0000b058, 0x00000000},
+        {0x0000b05c, 0x00000000},
+        {0x0000b060, 0x00000000},
+        {0x0000b064, 0x00000000},
+        {0x0000b068, 0x00000000},
+        {0x0000b06c, 0x00000000},
+        {0x0000b070, 0x00000000},
+        {0x0000b074, 0x00000000},
+        {0x0000b078, 0x00000000},
+        {0x0000b07c, 0x00000000},
+        {0x0000b080, 0x23232323},
+        {0x0000b084, 0x21232323},
+        {0x0000b088, 0x19191c1e},
+        {0x0000b08c, 0x12141417},
+        {0x0000b090, 0x07070e0e},
+        {0x0000b094, 0x03030305},
+        {0x0000b098, 0x00000003},
+        {0x0000b09c, 0x00000000},
+        {0x0000b0a0, 0x00000000},
+        {0x0000b0a4, 0x00000000},
+        {0x0000b0a8, 0x00000000},
+        {0x0000b0ac, 0x00000000},
+        {0x0000b0b0, 0x00000000},
+        {0x0000b0b4, 0x00000000},
+        {0x0000b0b8, 0x00000000},
+        {0x0000b0bc, 0x00000000},
+        {0x0000b0c0, 0x003f0020},
+        {0x0000b0c4, 0x00400041},
+        {0x0000b0c8, 0x0140005f},
+        {0x0000b0cc, 0x0160015f},
+        {0x0000b0d0, 0x017e017f},
+        {0x0000b0d4, 0x02410242},
+        {0x0000b0d8, 0x025f0240},
+        {0x0000b0dc, 0x027f0260},
+        {0x0000b0e0, 0x0341027e},
+        {0x0000b0e4, 0x035f0340},
+        {0x0000b0e8, 0x037f0360},
+        {0x0000b0ec, 0x04400441},
+        {0x0000b0f0, 0x0460045f},
+        {0x0000b0f4, 0x0541047f},
+        {0x0000b0f8, 0x055f0540},
+        {0x0000b0fc, 0x057f0560},
+        {0x0000b100, 0x06400641},
+        {0x0000b104, 0x0660065f},
+        {0x0000b108, 0x067e067f},
+        {0x0000b10c, 0x07410742},
+        {0x0000b110, 0x075f0740},
+        {0x0000b114, 0x077f0760},
+        {0x0000b118, 0x07800781},
+        {0x0000b11c, 0x07a0079f},
+        {0x0000b120, 0x07c107bf},
+        {0x0000b124, 0x000007c0},
+        {0x0000b128, 0x00000000},
+        {0x0000b12c, 0x00000000},
+        {0x0000b130, 0x00000000},
+        {0x0000b134, 0x00000000},
+        {0x0000b138, 0x00000000},
+        {0x0000b13c, 0x00000000},
+        {0x0000b140, 0x003f0020},
+        {0x0000b144, 0x00400041},
+        {0x0000b148, 0x0140005f},
+        {0x0000b14c, 0x0160015f},
+        {0x0000b150, 0x017e017f},
+        {0x0000b154, 0x02410242},
+        {0x0000b158, 0x025f0240},
+        {0x0000b15c, 0x027f0260},
+        {0x0000b160, 0x0341027e},
+        {0x0000b164, 0x035f0340},
+        {0x0000b168, 0x037f0360},
+        {0x0000b16c, 0x04400441},
+        {0x0000b170, 0x0460045f},
+        {0x0000b174, 0x0541047f},
+        {0x0000b178, 0x055f0540},
+        {0x0000b17c, 0x057f0560},
+        {0x0000b180, 0x06400641},
+        {0x0000b184, 0x0660065f},
+        {0x0000b188, 0x067e067f},
+        {0x0000b18c, 0x07410742},
+        {0x0000b190, 0x075f0740},
+        {0x0000b194, 0x077f0760},
+        {0x0000b198, 0x07800781},
+        {0x0000b19c, 0x07a0079f},
+        {0x0000b1a0, 0x07c107bf},
+        {0x0000b1a4, 0x000007c0},
+        {0x0000b1a8, 0x00000000},
+        {0x0000b1ac, 0x00000000},
+        {0x0000b1b0, 0x00000000},
+        {0x0000b1b4, 0x00000000},
+        {0x0000b1b8, 0x00000000},
+        {0x0000b1bc, 0x00000000},
+        {0x0000b1c0, 0x00000000},
+        {0x0000b1c4, 0x00000000},
+        {0x0000b1c8, 0x00000000},
+        {0x0000b1cc, 0x00000000},
+        {0x0000b1d0, 0x00000000},
+        {0x0000b1d4, 0x00000000},
+        {0x0000b1d8, 0x00000000},
+        {0x0000b1dc, 0x00000000},
+        {0x0000b1e0, 0x00000000},
+        {0x0000b1e4, 0x00000000},
+        {0x0000b1e8, 0x00000000},
+        {0x0000b1ec, 0x00000000},
+        {0x0000b1f0, 0x00000396},
+        {0x0000b1f4, 0x00000396},
+        {0x0000b1f8, 0x00000396},
+        {0x0000b1fc, 0x00000196},
+};
+
+static const u32 qca956x_1p0_xlna_only[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00009820, 0x206a022e, 0x206a022e, 0x206a01ae, 0x206a01ae},
+        {0x00009824, 0x5ac640d0, 0x5ac640d0, 0x5ac621f1, 0x5ac621f1},
+        {0x00009828, 0x06903081, 0x06903081, 0x07d43881, 0x07d43881},
+        {0x00009e00, 0x0372111a, 0x0372111a, 0x037216a0, 0x03721720},
+        {0x00009e0c, 0x6c4000e2, 0x6d4000e2, 0x6d4000de, 0x6c4000da},
+        {0x00009e10, 0x7ec88d2e, 0x7ec88d2e, 0x7ec86d2e, 0x7ec8ad2e},
+        {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x317a6062, 0x317a5ae2},
+        {0x00009e18, 0x00000000, 0x00000000, 0x03c00000, 0x03c00000},
+        {0x00009e20, 0x000003b5, 0x000003b5, 0x000003b2, 0x000003b2},
+        {0x00009fc0, 0x813e4788, 0x813e4788, 0x813e4789, 0x813e4789},
+        {0x0000ae18, 0x00000000, 0x00000000, 0x03c00000, 0x03c00000},
+        {0x0000ae20, 0x000001b5, 0x000001b5, 0x000001b2, 0x000001b2},
+        {0x0000be18, 0x00000000, 0x00000000, 0x03c00000, 0x03c00000},
+        {0x0000be20, 0x000001b5, 0x000001b5, 0x000001b2, 0x000001b2},
+};
+
+#endif /* INITVALS_956X_H */
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 1a9fe0983a6b..0f8e9464e4ab 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -34,7 +34,7 @@ struct ath_vif;
 
 extern struct ieee80211_ops ath9k_ops;
 extern int ath9k_modparam_nohwcrypt;
-extern int led_blink;
+extern int ath9k_led_blink;
 extern bool is_ath9k_unloaded;
 extern int ath9k_use_chanctx;
 
@@ -830,14 +830,9 @@ static inline void ath_fill_led_pin(struct ath_softc *sc)
 /* Wake on Wireless LAN */
 /************************/
 
-struct ath9k_wow_pattern {
-        u8 pattern_bytes[MAX_PATTERN_SIZE];
-        u8 mask_bytes[MAX_PATTERN_SIZE];
-        u32 pattern_len;
-};
-
 #ifdef CONFIG_ATH9K_WOW
 void ath9k_init_wow(struct ieee80211_hw *hw);
+void ath9k_deinit_wow(struct ieee80211_hw *hw);
 int ath9k_suspend(struct ieee80211_hw *hw,
                   struct cfg80211_wowlan *wowlan);
 int ath9k_resume(struct ieee80211_hw *hw);
@@ -846,6 +841,9 @@ void ath9k_set_wakeup(struct ieee80211_hw *hw, bool enabled);
 static inline void ath9k_init_wow(struct ieee80211_hw *hw)
 {
 }
+static inline void ath9k_deinit_wow(struct ieee80211_hw *hw)
+{
+}
 static inline int ath9k_suspend(struct ieee80211_hw *hw,
                                 struct cfg80211_wowlan *wowlan)
 {
@@ -1039,9 +1037,8 @@ struct ath_softc {
         s16 tx99_power;
 
 #ifdef CONFIG_ATH9K_WOW
-        atomic_t wow_got_bmiss_intr;
-        atomic_t wow_sleep_proc_intr; /* in the middle of WoW sleep ? */
         u32 wow_intr_before_sleep;
+        bool force_wow;
 #endif
 };
 
diff --git a/drivers/net/wireless/ath/ath9k/common-spectral.c b/drivers/net/wireless/ath/ath9k/common-spectral.c
index ec93ddf0863a..5cee231cca1f 100644
--- a/drivers/net/wireless/ath/ath9k/common-spectral.c
+++ b/drivers/net/wireless/ath/ath9k/common-spectral.c
@@ -582,7 +582,7 @@ static struct rchan_callbacks rfs_spec_scan_cb = {
 
 void ath9k_cmn_spectral_deinit_debug(struct ath_spec_scan_priv *spec_priv)
 {
-        if (config_enabled(CONFIG_ATH9K_DEBUGFS) && spec_priv->rfs_chan_spec_scan) {
+        if (config_enabled(CONFIG_ATH9K_DEBUGFS)) {
                 relay_close(spec_priv->rfs_chan_spec_scan);
                 spec_priv->rfs_chan_spec_scan = NULL;
         }
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 871e969409bf..50a2e0ac3b8b 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -403,7 +403,8 @@ static const struct file_operations fops_antenna_diversity = {
 
 static int read_file_dma(struct seq_file *file, void *data)
 {
-        struct ath_softc *sc = file->private;
+        struct ieee80211_hw *hw = dev_get_drvdata(file->private);
+        struct ath_softc *sc = hw->priv;
         struct ath_hw *ah = sc->sc_ah;
         u32 val[ATH9K_NUM_DMA_DEBUG_REGS];
         int i, qcuOffset = 0, dcuOffset = 0;
@@ -470,20 +471,6 @@ static int read_file_dma(struct seq_file *file, void *data)
         return 0;
 }
 
-static int open_file_dma(struct inode *inode, struct file *f)
-{
-        return single_open(f, read_file_dma, inode->i_private);
-}
-
-static const struct file_operations fops_dma = {
-        .open = open_file_dma,
-        .read = seq_read,
-        .owner = THIS_MODULE,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
-
-
 void ath_debug_stat_interrupt(struct ath_softc *sc, enum ath9k_int status)
 {
         if (status)
@@ -539,7 +526,8 @@ void ath_debug_stat_interrupt(struct ath_softc *sc, enum ath9k_int status)
 
 static int read_file_interrupt(struct seq_file *file, void *data)
 {
-        struct ath_softc *sc = file->private;
+        struct ieee80211_hw *hw = dev_get_drvdata(file->private);
+        struct ath_softc *sc = hw->priv;
 
 #define PR_IS(a, s)                                             \
         do {                                                    \
@@ -600,22 +588,10 @@ static int read_file_interrupt(struct seq_file *file, void *data)
         return 0;
 }
 
-static int open_file_interrupt(struct inode *inode, struct file *f)
-{
-        return single_open(f, read_file_interrupt, inode->i_private);
-}
-
-static const struct file_operations fops_interrupt = {
-        .read = seq_read,
-        .open = open_file_interrupt,
-        .owner = THIS_MODULE,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
-
 static int read_file_xmit(struct seq_file *file, void *data)
 {
-        struct ath_softc *sc = file->private;
+        struct ieee80211_hw *hw = dev_get_drvdata(file->private);
+        struct ath_softc *sc = hw->priv;
 
         seq_printf(file, "%30s %10s%10s%10s\n\n", "BE", "BK", "VI", "VO");
 
@@ -661,7 +637,8 @@ static void print_queue(struct ath_softc *sc, struct ath_txq *txq,
 
 static int read_file_queues(struct seq_file *file, void *data)
 {
-        struct ath_softc *sc = file->private;
+        struct ieee80211_hw *hw = dev_get_drvdata(file->private);
+        struct ath_softc *sc = hw->priv;
         struct ath_txq *txq;
         int i;
         static const char *qname[4] = {
@@ -682,7 +659,8 @@ static int read_file_queues(struct seq_file *file, void *data)
 
 static int read_file_misc(struct seq_file *file, void *data)
 {
-        struct ath_softc *sc = file->private;
+        struct ieee80211_hw *hw = dev_get_drvdata(file->private);
+        struct ath_softc *sc = hw->priv;
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath9k_vif_iter_data iter_data;
         struct ath_chanctx *ctx;
@@ -773,7 +751,8 @@ static int read_file_misc(struct seq_file *file, void *data)
 
 static int read_file_reset(struct seq_file *file, void *data)
 {
-        struct ath_softc *sc = file->private;
+        struct ieee80211_hw *hw = dev_get_drvdata(file->private);
+        struct ath_softc *sc = hw->priv;
         static const char * const reset_cause[__RESET_TYPE_MAX] = {
                 [RESET_TYPE_BB_HANG] = "Baseband Hang",
                 [RESET_TYPE_BB_WATCHDOG] = "Baseband Watchdog",
@@ -837,58 +816,6 @@ void ath_debug_stat_tx(struct ath_softc *sc, struct ath_buf *bf,
                 TX_STAT_INC(qnum, delim_underrun);
 }
 
-static int open_file_xmit(struct inode *inode, struct file *f)
-{
-        return single_open(f, read_file_xmit, inode->i_private);
-}
-
-static const struct file_operations fops_xmit = {
-        .read = seq_read,
-        .open = open_file_xmit,
-        .owner = THIS_MODULE,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
-
-static int open_file_queues(struct inode *inode, struct file *f)
-{
-        return single_open(f, read_file_queues, inode->i_private);
-}
-
-static const struct file_operations fops_queues = {
-        .read = seq_read,
-        .open = open_file_queues,
-        .owner = THIS_MODULE,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
-
-static int open_file_misc(struct inode *inode, struct file *f)
-{
-        return single_open(f, read_file_misc, inode->i_private);
-}
-
-static const struct file_operations fops_misc = {
-        .read = seq_read,
-        .open = open_file_misc,
-        .owner = THIS_MODULE,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
-
-static int open_file_reset(struct inode *inode, struct file *f)
-{
-        return single_open(f, read_file_reset, inode->i_private);
-}
-
-static const struct file_operations fops_reset = {
-        .read = seq_read,
-        .open = open_file_reset,
-        .owner = THIS_MODULE,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
-
 void ath_debug_stat_rx(struct ath_softc *sc, struct ath_rx_status *rs)
 {
         ath9k_cmn_debug_stat_rx(&sc->debug.stats.rxstats, rs);
@@ -1018,7 +945,8 @@ static const struct file_operations fops_regdump = {
 
 static int read_file_dump_nfcal(struct seq_file *file, void *data)
 {
-        struct ath_softc *sc = file->private;
+        struct ieee80211_hw *hw = dev_get_drvdata(file->private);
+        struct ath_softc *sc = hw->priv;
         struct ath_hw *ah = sc->sc_ah;
         struct ath9k_nfcal_hist *h = sc->cur_chan->caldata.nfCalHist;
         struct ath_common *common = ath9k_hw_common(ah);
@@ -1115,6 +1043,133 @@ static const struct file_operations fops_ackto = {
 };
 #endif
 
+#ifdef CONFIG_ATH9K_WOW
+
+static ssize_t read_file_wow(struct file *file, char __user *user_buf,
+                             size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        unsigned int len = 0, size = 32;
+        ssize_t retval;
+        char *buf;
+
+        buf = kzalloc(size, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        len += scnprintf(buf + len, size - len, "WOW: %s\n",
+                         sc->force_wow ? "ENABLED" : "DISABLED");
+
+        if (len > size)
+                len = size;
+
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+
+        return retval;
+}
+
+static ssize_t write_file_wow(struct file *file, const char __user *user_buf,
+                              size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        unsigned long val;
+        char buf[32];
+        ssize_t len;
+
+        len = min(count, sizeof(buf) - 1);
+        if (copy_from_user(buf, user_buf, len))
+                return -EFAULT;
+
+        buf[len] = '\0';
+        if (kstrtoul(buf, 0, &val))
+                return -EINVAL;
+
+        if (val != 1)
+                return -EINVAL;
+
+        if (!sc->force_wow) {
+                sc->force_wow = true;
+                ath9k_init_wow(sc->hw);
+        }
+
+        return count;
+}
+
+static const struct file_operations fops_wow = {
+        .read = read_file_wow,
+        .write = write_file_wow,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+#endif
+
+static ssize_t read_file_tpc(struct file *file, char __user *user_buf,
+                             size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        struct ath_hw *ah = sc->sc_ah;
+        unsigned int len = 0, size = 32;
+        ssize_t retval;
+        char *buf;
+
+        buf = kzalloc(size, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        len += scnprintf(buf + len, size - len, "%s\n",
+                         ah->tpc_enabled ? "ENABLED" : "DISABLED");
+
+        if (len > size)
+                len = size;
+
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+
+        return retval;
+}
+
+static ssize_t write_file_tpc(struct file *file, const char __user *user_buf,
+                              size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        struct ath_hw *ah = sc->sc_ah;
+        unsigned long val;
+        char buf[32];
+        ssize_t len;
+        bool tpc_enabled;
+
+        len = min(count, sizeof(buf) - 1);
+        if (copy_from_user(buf, user_buf, len))
+                return -EFAULT;
+
+        buf[len] = '\0';
+        if (kstrtoul(buf, 0, &val))
+                return -EINVAL;
+
+        if (val < 0 || val > 1)
+                return -EINVAL;
+
+        tpc_enabled = !!val;
+
+        if (tpc_enabled != ah->tpc_enabled) {
+                ah->tpc_enabled = tpc_enabled;
+                ath9k_hw_set_txpowerlimit(ah, sc->cur_chan->txpower, false);
+        }
+
+        return count;
+}
+
+static const struct file_operations fops_tpc = {
+        .read = read_file_tpc,
+        .write = write_file_tpc,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
 /* Ethtool support for get-stats */
 
 #define AMKSTR(nm) #nm "_BE", #nm "_BK", #nm "_VI", #nm "_VO"
@@ -1260,14 +1315,14 @@ int ath9k_init_debug(struct ath_hw *ah)
         ath9k_tx99_init_debug(sc);
         ath9k_cmn_spectral_init_debug(&sc->spec_priv, sc->debug.debugfs_phy);
 
-        debugfs_create_file("dma", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_dma);
-        debugfs_create_file("interrupt", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_interrupt);
-        debugfs_create_file("xmit", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_xmit);
-        debugfs_create_file("queues", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_queues);
+        debugfs_create_devm_seqfile(sc->dev, "dma", sc->debug.debugfs_phy,
+                                    read_file_dma);
+        debugfs_create_devm_seqfile(sc->dev, "interrupt", sc->debug.debugfs_phy,
+                                    read_file_interrupt);
+        debugfs_create_devm_seqfile(sc->dev, "xmit", sc->debug.debugfs_phy,
+                                    read_file_xmit);
+        debugfs_create_devm_seqfile(sc->dev, "queues", sc->debug.debugfs_phy,
+                                    read_file_queues);
         debugfs_create_u32("qlen_bk", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
                            &sc->tx.txq_max_pending[IEEE80211_AC_BK]);
         debugfs_create_u32("qlen_be", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
@@ -1276,10 +1331,10 @@ int ath9k_init_debug(struct ath_hw *ah)
                            &sc->tx.txq_max_pending[IEEE80211_AC_VI]);
         debugfs_create_u32("qlen_vo", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
                            &sc->tx.txq_max_pending[IEEE80211_AC_VO]);
-        debugfs_create_file("misc", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_misc);
-        debugfs_create_file("reset", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_reset);
+        debugfs_create_devm_seqfile(sc->dev, "misc", sc->debug.debugfs_phy,
+                                    read_file_misc);
+        debugfs_create_devm_seqfile(sc->dev, "reset", sc->debug.debugfs_phy,
+                                    read_file_reset);
 
         ath9k_cmn_debug_recv(sc->debug.debugfs_phy, &sc->debug.stats.rxstats);
         ath9k_cmn_debug_phy_err(sc->debug.debugfs_phy, &sc->debug.stats.rxstats);
@@ -1301,8 +1356,9 @@ int ath9k_init_debug(struct ath_hw *ah)
                             &ah->config.cwm_ignore_extcca);
         debugfs_create_file("regdump", S_IRUSR, sc->debug.debugfs_phy, sc,
                             &fops_regdump);
-        debugfs_create_file("dump_nfcal", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_dump_nfcal);
+        debugfs_create_devm_seqfile(sc->dev, "dump_nfcal",
+                                    sc->debug.debugfs_phy,
+                                    read_file_dump_nfcal);
 
         ath9k_cmn_debug_base_eeprom(sc->debug.debugfs_phy, sc->sc_ah);
         ath9k_cmn_debug_modal_eeprom(sc->debug.debugfs_phy, sc->sc_ah);
@@ -1320,10 +1376,17 @@ int ath9k_init_debug(struct ath_hw *ah)
                             &fops_btcoex);
 #endif
 
+#ifdef CONFIG_ATH9K_WOW
+        debugfs_create_file("wow", S_IRUSR | S_IWUSR,
+                            sc->debug.debugfs_phy, sc, &fops_wow);
+#endif
+
 #ifdef CONFIG_ATH9K_DYNACK
         debugfs_create_file("ack_to", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
                             sc, &fops_ackto);
 #endif
+        debugfs_create_file("tpc", S_IRUSR | S_IWUSR,
+                            sc->debug.debugfs_phy, sc, &fops_tpc);
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_4k.c b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
index 07b806c56c56..e5a78d4fd66e 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_4k.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
@@ -748,6 +748,20 @@ static void ath9k_hw_4k_set_txpower(struct ath_hw *ah,
                           | ATH9K_POW_SM(ratesArray[rateDupCck], 0));
         }
 
+        /* TPC initializations */
+        if (ah->tpc_enabled) {
+                int ht40_delta;
+
+                ht40_delta = (IS_CHAN_HT40(chan)) ? ht40PowerIncForPdadc : 0;
+                ar5008_hw_init_rate_txpower(ah, ratesArray, chan, ht40_delta);
+                /* Enable TPC */
+                REG_WRITE(ah, AR_PHY_POWER_TX_RATE_MAX,
+                        MAX_RATE_POWER | AR_PHY_POWER_TX_RATE_MAX_TPC_ENABLE);
+        } else {
+                /* Disable TPC */
+                REG_WRITE(ah, AR_PHY_POWER_TX_RATE_MAX, MAX_RATE_POWER);
+        }
+
         REGWRITE_BUFFER_FLUSH(ah);
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_9287.c b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
index 5ba1385c9838..6ca33dfde1fd 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
@@ -886,6 +886,21 @@ static void ath9k_hw_ar9287_set_txpower(struct ath_hw *ah,
                           | ATH9K_POW_SM(ratesArray[rateDupOfdm], 8)
                           | ATH9K_POW_SM(ratesArray[rateDupCck], 0));
         }
+
+        /* TPC initializations */
+        if (ah->tpc_enabled) {
+                int ht40_delta;
+
+                ht40_delta = (IS_CHAN_HT40(chan)) ? ht40PowerIncForPdadc : 0;
+                ar5008_hw_init_rate_txpower(ah, ratesArray, chan, ht40_delta);
+                /* Enable TPC */
+                REG_WRITE(ah, AR_PHY_POWER_TX_RATE_MAX,
+                        MAX_RATE_POWER | AR_PHY_POWER_TX_RATE_MAX_TPC_ENABLE);
+        } else {
+                /* Disable TPC */
+                REG_WRITE(ah, AR_PHY_POWER_TX_RATE_MAX, MAX_RATE_POWER);
+        }
+
         REGWRITE_BUFFER_FLUSH(ah);
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_def.c b/drivers/net/wireless/ath/ath9k/eeprom_def.c
index 122b846b8ec0..098059039351 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_def.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c
@@ -1332,6 +1332,20 @@ static void ath9k_hw_def_set_txpower(struct ath_hw *ah,
                   ATH9K_POW_SM(pModal->pwrDecreaseFor3Chain, 6)
                   | ATH9K_POW_SM(pModal->pwrDecreaseFor2Chain, 0));
 
+        /* TPC initializations */
+        if (ah->tpc_enabled) {
+                int ht40_delta;
+
+                ht40_delta = (IS_CHAN_HT40(chan)) ? ht40PowerIncForPdadc : 0;
+                ar5008_hw_init_rate_txpower(ah, ratesArray, chan, ht40_delta);
+                /* Enable TPC */
+                REG_WRITE(ah, AR_PHY_POWER_TX_RATE_MAX,
+                        MAX_RATE_POWER | AR_PHY_POWER_TX_RATE_MAX_TPC_ENABLE);
+        } else {
+                /* Disable TPC */
+                REG_WRITE(ah, AR_PHY_POWER_TX_RATE_MAX, MAX_RATE_POWER);
+        }
+
         REGWRITE_BUFFER_FLUSH(ah);
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/gpio.c b/drivers/net/wireless/ath/ath9k/gpio.c
index 2fef7a480fec..da344b27326c 100644
--- a/drivers/net/wireless/ath/ath9k/gpio.c
+++ b/drivers/net/wireless/ath/ath9k/gpio.c
@@ -49,7 +49,7 @@ void ath_init_leds(struct ath_softc *sc)
         if (AR_SREV_9100(sc->sc_ah))
                 return;
 
-        if (!led_blink)
+        if (!ath9k_led_blink)
                 sc->led_cdev.default_trigger =
                         ieee80211_get_radio_led_name(sc->hw);
 
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index 9dde265d3f84..300d3671d0ef 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -44,6 +44,9 @@
 
 extern struct ieee80211_ops ath9k_htc_ops;
 extern int htc_modparam_nohwcrypt;
+#ifdef CONFIG_MAC80211_LEDS
+extern int ath9k_htc_led_blink;
+#endif
 
 enum htc_phymode {
         HTC_MODE_11NA           = 0,
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_gpio.c b/drivers/net/wireless/ath/ath9k/htc_drv_gpio.c
index 50f74a2a4cf8..2aabcbdaba4e 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_gpio.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_gpio.c
@@ -279,6 +279,10 @@ void ath9k_init_leds(struct ath9k_htc_priv *priv)
         else
                 priv->ah->led_pin = ATH_LED_PIN_DEF;
 
+        if (!ath9k_htc_led_blink)
+                priv->led_cdev.default_trigger =
+                        ieee80211_get_radio_led_name(priv->hw);
+
         ath9k_configure_leds(priv);
 
         snprintf(priv->led_name, sizeof(priv->led_name),
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index e8fa9448da24..fd229409f676 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -39,6 +39,10 @@ module_param_named(ps_enable, ath9k_ps_enable, int, 0444);
 MODULE_PARM_DESC(ps_enable, "Enable WLAN PowerSave");
 
 #ifdef CONFIG_MAC80211_LEDS
+int ath9k_htc_led_blink = 1;
+module_param_named(blink, ath9k_htc_led_blink, int, 0444);
+MODULE_PARM_DESC(blink, "Enable LED blink on activity");
+
 static const struct ieee80211_tpt_blink ath9k_htc_tpt_blink[] = {
         { .throughput = 0 * 1024, .blink_time = 334 },
         { .throughput = 1 * 1024, .blink_time = 260 },
diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
index a0ff5b637054..d2408da38c1c 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
@@ -351,11 +351,7 @@ void ath9k_htc_txcompletion_cb(struct htc_target *htc_handle,
 
         return;
 ret:
-        /* HTC-generated packets are freed here. */
-        if (htc_hdr && htc_hdr->endpoint_id != ENDPOINT0)
-                dev_kfree_skb_any(skb);
-        else
-                kfree_skb(skb);
+        kfree_skb(skb);
 }
 
 static void ath9k_htc_fw_panic_report(struct htc_target *htc_handle,
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 6d4b273469b1..60aa8d71e753 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -246,6 +246,8 @@ static void ath9k_hw_read_revisions(struct ath_hw *ah)
         case AR9300_DEVID_AR953X:
                 ah->hw_version.macVersion = AR_SREV_VERSION_9531;
                 return;
+        case AR9300_DEVID_QCA956X:
+                ah->hw_version.macVersion = AR_SREV_VERSION_9561;
         }
 
         val = REG_READ(ah, AR_SREV) & AR_SREV_ID;
@@ -422,6 +424,8 @@ static void ath9k_hw_init_defaults(struct ath_hw *ah)
         ah->power_mode = ATH9K_PM_UNDEFINED;
         ah->htc_reset_init = true;
 
+        ah->tpc_enabled = true;
+
         ah->ani_function = ATH9K_ANI_ALL;
         if (!AR_SREV_9300_20_OR_LATER(ah))
                 ah->ani_function &= ~ATH9K_ANI_MRC_CCK;
@@ -536,6 +540,7 @@ static int __ath9k_hw_init(struct ath_hw *ah)
         case AR_SREV_VERSION_9550:
         case AR_SREV_VERSION_9565:
         case AR_SREV_VERSION_9531:
+        case AR_SREV_VERSION_9561:
                 break;
         default:
                 ath_err(common,
@@ -636,6 +641,7 @@ int ath9k_hw_init(struct ath_hw *ah)
         case AR9485_DEVID_AR1111:
         case AR9300_DEVID_AR9565:
         case AR9300_DEVID_AR953X:
+        case AR9300_DEVID_QCA956X:
                 break;
         default:
                 if (common->bus_ops->ath_bus_type == ATH_USB)
@@ -776,7 +782,8 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
                 /* program BB PLL phase_shift */
                 REG_RMW_FIELD(ah, AR_CH0_BB_DPLL3,
                               AR_CH0_BB_DPLL3_PHASE_SHIFT, 0x1);
-        } else if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
+        } else if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah) ||
+                   AR_SREV_9561(ah)) {
                 u32 regval, pll2_divint, pll2_divfrac, refdiv;
 
                 REG_WRITE(ah, AR_RTC_PLL_CONTROL,
@@ -787,7 +794,7 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
                 udelay(100);
 
                 if (ah->is_clk_25mhz) {
-                        if (AR_SREV_9531(ah)) {
+                        if (AR_SREV_9531(ah) || AR_SREV_9561(ah)) {
                                 pll2_divint = 0x1c;
                                 pll2_divfrac = 0xa3d2;
                                 refdiv = 1;
@@ -803,14 +810,15 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
                                 refdiv = 5;
                         } else {
                                 pll2_divint = 0x11;
-                                pll2_divfrac =
-                                        AR_SREV_9531(ah) ? 0x26665 : 0x26666;
+                                pll2_divfrac = (AR_SREV_9531(ah) ||
+                                                AR_SREV_9561(ah)) ?
+                                                0x26665 : 0x26666;
                                 refdiv = 1;
                         }
                 }
 
                 regval = REG_READ(ah, AR_PHY_PLL_MODE);
-                if (AR_SREV_9531(ah))
+                if (AR_SREV_9531(ah) || AR_SREV_9561(ah))
                         regval |= (0x1 << 22);
                 else
                         regval |= (0x1 << 16);
@@ -828,14 +836,16 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
                                 (0x1 << 13) |
                                 (0x4 << 26) |
                                 (0x18 << 19);
-                else if (AR_SREV_9531(ah))
+                else if (AR_SREV_9531(ah) || AR_SREV_9561(ah)) {
                         regval = (regval & 0x01c00fff) |
                                 (0x1 << 31) |
                                 (0x2 << 29) |
                                 (0xa << 25) |
-                                (0x1 << 19) |
-                                (0x6 << 12);
-                else
+                                (0x1 << 19);
+
+                        if (AR_SREV_9531(ah))
+                                regval |= (0x6 << 12);
+                } else
                         regval = (regval & 0x80071fff) |
                                 (0x3 << 30) |
                                 (0x1 << 13) |
@@ -843,7 +853,7 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
                                 (0x60 << 19);
                 REG_WRITE(ah, AR_PHY_PLL_MODE, regval);
 
-                if (AR_SREV_9531(ah))
+                if (AR_SREV_9531(ah) || AR_SREV_9561(ah))
                         REG_WRITE(ah, AR_PHY_PLL_MODE,
                                   REG_READ(ah, AR_PHY_PLL_MODE) & 0xffbfffff);
                 else
@@ -882,7 +892,8 @@ static void ath9k_hw_init_interrupt_masks(struct ath_hw *ah,
                 AR_IMR_RXORN |
                 AR_IMR_BCNMISC;
 
-        if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah))
+        if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah) ||
+            AR_SREV_9561(ah))
                 sync_default &= ~AR_INTR_SYNC_HOST1_FATAL;
 
         if (AR_SREV_9300_20_OR_LATER(ah)) {
@@ -1671,7 +1682,8 @@ static void ath9k_hw_init_desc(struct ath_hw *ah)
                 }
 #ifdef __BIG_ENDIAN
                 else if (AR_SREV_9330(ah) || AR_SREV_9340(ah) ||
-                         AR_SREV_9550(ah) || AR_SREV_9531(ah))
+                         AR_SREV_9550(ah) || AR_SREV_9531(ah) ||
+                         AR_SREV_9561(ah))
                         REG_RMW(ah, AR_CFG, AR_CFG_SWRB | AR_CFG_SWTB, 0);
                 else
                         REG_WRITE(ah, AR_CFG, AR_CFG_SWTD | AR_CFG_SWRD);
@@ -2459,7 +2471,8 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
 
         if (AR_SREV_9300_20_OR_LATER(ah)) {
                 pCap->hw_caps |= ATH9K_HW_CAP_EDMA | ATH9K_HW_CAP_FASTCLOCK;
-                if (!AR_SREV_9330(ah) && !AR_SREV_9485(ah) && !AR_SREV_9565(ah))
+                if (!AR_SREV_9330(ah) && !AR_SREV_9485(ah) &&
+                    !AR_SREV_9561(ah) && !AR_SREV_9565(ah))
                         pCap->hw_caps |= ATH9K_HW_CAP_LDPC;
 
                 pCap->rx_hp_qdepth = ATH9K_HW_RX_HP_QDEPTH;
@@ -2476,7 +2489,9 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
         if (AR_SREV_9300_20_OR_LATER(ah))
                 pCap->hw_caps |= ATH9K_HW_CAP_RAC_SUPPORTED;
 
-        if (AR_SREV_9300_20_OR_LATER(ah))
+        if (AR_SREV_9561(ah))
+                ah->ent_mode = 0x3BDA000;
+        else if (AR_SREV_9300_20_OR_LATER(ah))
                 ah->ent_mode = REG_READ(ah, AR_ENT_OTP);
 
         if (AR_SREV_9287_11_OR_LATER(ah) || AR_SREV_9271(ah))
@@ -2529,13 +2544,17 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
                         pCap->hw_caps |= ATH9K_HW_CAP_RTT;
         }
 
-        if (AR_SREV_9462(ah))
-                pCap->hw_caps |= ATH9K_HW_WOW_DEVICE_CAPABLE;
-
         if (AR_SREV_9300_20_OR_LATER(ah) &&
             ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
                         pCap->hw_caps |= ATH9K_HW_CAP_PAPRD;
 
+#ifdef CONFIG_ATH9K_WOW
+        if (AR_SREV_9462_20_OR_LATER(ah) || AR_SREV_9565_11_OR_LATER(ah))
+                ah->wow.max_patterns = MAX_NUM_PATTERN;
+        else
+                ah->wow.max_patterns = MAX_NUM_PATTERN_LEGACY;
+#endif
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 1cbd33551513..e82e570de330 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -54,6 +54,7 @@
 #define AR9485_DEVID_AR1111     0x0037
 #define AR9300_DEVID_AR9565     0x0036
 #define AR9300_DEVID_AR953X     0x003d
+#define AR9300_DEVID_QCA956X    0x003f
 
 #define AR5416_AR9100_DEVID     0x000b
 
@@ -198,12 +199,13 @@
 #define KAL_NUM_DESC_WORDS      12
 #define KAL_ANTENNA_MODE        1
 #define KAL_TO_DS               1
-#define KAL_DELAY               4       /*delay of 4ms between 2 KAL frames */
+#define KAL_DELAY               4       /* delay of 4ms between 2 KAL frames */
 #define KAL_TIMEOUT             900
 
 #define MAX_PATTERN_SIZE                256
 #define MAX_PATTERN_MASK_SIZE           32
-#define MAX_NUM_PATTERN                 8
+#define MAX_NUM_PATTERN                 16
+#define MAX_NUM_PATTERN_LEGACY          8
 #define MAX_NUM_USER_PATTERN            6 /*  deducting the disassociate and
                                               deauthenticate packets */
 
@@ -247,12 +249,10 @@ enum ath9k_hw_caps {
 #ifdef CONFIG_ATH9K_PCOEM
         ATH9K_HW_CAP_RTT                        = BIT(14),
         ATH9K_HW_CAP_MCI                        = BIT(15),
-        ATH9K_HW_WOW_DEVICE_CAPABLE             = BIT(16),
         ATH9K_HW_CAP_BT_ANT_DIV                 = BIT(17),
 #else
         ATH9K_HW_CAP_RTT                        = 0,
         ATH9K_HW_CAP_MCI                        = 0,
-        ATH9K_HW_WOW_DEVICE_CAPABLE             = 0,
         ATH9K_HW_CAP_BT_ANT_DIV                 = 0,
 #endif
         ATH9K_HW_CAP_DFS                        = BIT(18),
@@ -271,6 +271,12 @@ enum ath9k_hw_caps {
  * of those types.
  */
 
+struct ath9k_hw_wow {
+        u32 wow_event_mask;
+        u32 wow_event_mask2;
+        u8 max_patterns;
+};
+
 struct ath9k_hw_capabilities {
         u32 hw_caps; /* ATH9K_HW_CAP_* from ath9k_hw_caps */
         u16 rts_aggr_limit;
@@ -929,7 +935,7 @@ struct ath_hw {
         u32 ent_mode;
 
 #ifdef CONFIG_ATH9K_WOW
-        u32 wow_event_mask;
+        struct ath9k_hw_wow wow;
 #endif
         bool is_clk_25mhz;
         int (*get_mac_revision)(void);
@@ -1086,6 +1092,8 @@ bool ar9003_is_paprd_enabled(struct ath_hw *ah);
 void ar9003_hw_set_chain_masks(struct ath_hw *ah, u8 rx, u8 tx);
 void ar9003_hw_init_rate_txpower(struct ath_hw *ah, u8 *rate_array,
                                  struct ath9k_channel *chan);
+void ar5008_hw_init_rate_txpower(struct ath_hw *ah, int16_t *rate_array,
+                                 struct ath9k_channel *chan, int ht40_delta);
 
 /* Hardware family op attach helpers */
 int ar5008_hw_attach_phy_ops(struct ath_hw *ah);
@@ -1145,23 +1153,19 @@ ath9k_hw_get_btcoex_scheme(struct ath_hw *ah)
 
 
 #ifdef CONFIG_ATH9K_WOW
-const char *ath9k_hw_wow_event_to_string(u32 wow_event);
-void ath9k_hw_wow_apply_pattern(struct ath_hw *ah, u8 *user_pattern,
-                                u8 *user_mask, int pattern_count,
-                                int pattern_len);
+int ath9k_hw_wow_apply_pattern(struct ath_hw *ah, u8 *user_pattern,
+                               u8 *user_mask, int pattern_count,
+                               int pattern_len);
 u32 ath9k_hw_wow_wakeup(struct ath_hw *ah);
 void ath9k_hw_wow_enable(struct ath_hw *ah, u32 pattern_enable);
 #else
-static inline const char *ath9k_hw_wow_event_to_string(u32 wow_event)
-{
-        return NULL;
-}
-static inline void ath9k_hw_wow_apply_pattern(struct ath_hw *ah,
-                                              u8 *user_pattern,
-                                              u8 *user_mask,
-                                              int pattern_count,
-                                              int pattern_len)
+static inline int ath9k_hw_wow_apply_pattern(struct ath_hw *ah,
+                                             u8 *user_pattern,
+                                             u8 *user_mask,
+                                             int pattern_count,
+                                             int pattern_len)
 {
+        return 0;
 }
 static inline u32 ath9k_hw_wow_wakeup(struct ath_hw *ah)
 {
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index d1c39346b264..6c6e88495394 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -45,8 +45,8 @@ int ath9k_modparam_nohwcrypt;
 module_param_named(nohwcrypt, ath9k_modparam_nohwcrypt, int, 0444);
 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption");
 
-int led_blink;
-module_param_named(blink, led_blink, int, 0444);
+int ath9k_led_blink;
+module_param_named(blink, ath9k_led_blink, int, 0444);
 MODULE_PARM_DESC(blink, "Enable LED blink on activity");
 
 static int ath9k_btcoex_enable;
@@ -996,6 +996,7 @@ void ath9k_deinit_device(struct ath_softc *sc)
         ath9k_ps_restore(sc);
 
         ath9k_deinit_debug(sc);
+        ath9k_deinit_wow(hw);
         ieee80211_unregister_hw(hw);
         ath_rx_cleanup(sc);
         ath9k_deinit_softc(sc);
diff --git a/drivers/net/wireless/ath/ath9k/link.c b/drivers/net/wireless/ath/ath9k/link.c
index b829263e3d0a..90631d768a60 100644
--- a/drivers/net/wireless/ath/ath9k/link.c
+++ b/drivers/net/wireless/ath/ath9k/link.c
@@ -516,14 +516,14 @@ int ath_update_survey_stats(struct ath_softc *sc)
                 ath_hw_cycle_counters_update(common);
 
         if (cc->cycles > 0) {
-                survey->filled |= SURVEY_INFO_CHANNEL_TIME |
-                        SURVEY_INFO_CHANNEL_TIME_BUSY |
-                        SURVEY_INFO_CHANNEL_TIME_RX |
-                        SURVEY_INFO_CHANNEL_TIME_TX;
-                survey->channel_time += cc->cycles / div;
-                survey->channel_time_busy += cc->rx_busy / div;
-                survey->channel_time_rx += cc->rx_frame / div;
-                survey->channel_time_tx += cc->tx_frame / div;
+                survey->filled |= SURVEY_INFO_TIME |
+                        SURVEY_INFO_TIME_BUSY |
+                        SURVEY_INFO_TIME_RX |
+                        SURVEY_INFO_TIME_TX;
+                survey->time += cc->cycles / div;
+                survey->time_busy += cc->rx_busy / div;
+                survey->time_rx += cc->rx_frame / div;
+                survey->time_tx += cc->tx_frame / div;
         }
 
         if (cc->cycles < div)
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 3e58bfa0c1fd..bba85d1a6cd1 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -820,7 +820,8 @@ void ath9k_hw_enable_interrupts(struct ath_hw *ah)
                 return;
         }
 
-        if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah))
+        if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah) ||
+            AR_SREV_9561(ah))
                 sync_default &= ~AR_INTR_SYNC_HOST1_FATAL;
 
         async_mask = AR_INTR_MAC_IRQ;
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 62b0bf4fdf6b..9ede991b8d76 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -555,15 +555,6 @@ irqreturn_t ath_isr(int irq, void *dev)
             (status & ATH9K_INT_BB_WATCHDOG))
                 goto chip_reset;
 
-#ifdef CONFIG_ATH9K_WOW
-        if (status & ATH9K_INT_BMISS) {
-                if (atomic_read(&sc->wow_sleep_proc_intr) == 0) {
-                        atomic_inc(&sc->wow_got_bmiss_intr);
-                        atomic_dec(&sc->wow_sleep_proc_intr);
-                }
-        }
-#endif
-
         if (status & ATH9K_INT_SWBA)
                 tasklet_schedule(&sc->bcon_tasklet);
 
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index f009b5b57e5e..e6fef1be9977 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -427,6 +427,11 @@ static const struct pci_device_id ath_pci_id_table[] = {
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
                          0x11AD, /* LITEON */
+                         0x1842),
+          .driver_data = ATH9K_PCI_AR9565_1ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
                          0x6671),
           .driver_data = ATH9K_PCI_AR9565_1ANT },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
@@ -446,9 +451,19 @@ static const struct pci_device_id ath_pci_id_table[] = {
           .driver_data = ATH9K_PCI_AR9565_1ANT },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
+                         0x1B9A, /* XAVI */
+                         0x28A3),
+          .driver_data = ATH9K_PCI_AR9565_1ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
                          PCI_VENDOR_ID_AZWAVE,
                          0x218A),
           .driver_data = ATH9K_PCI_AR9565_1ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x2F8A),
+          .driver_data = ATH9K_PCI_AR9565_1ANT },
 
         /* WB335 1-ANT / Antenna Diversity */
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
@@ -508,6 +523,11 @@ static const struct pci_device_id ath_pci_id_table[] = {
           .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x213C),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
                          PCI_VENDOR_ID_HP,
                          0x18E3),
           .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
@@ -555,6 +575,16 @@ static const struct pci_device_id ath_pci_id_table[] = {
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
+                         PCI_VENDOR_ID_SAMSUNG,
+                         0x4129),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_SAMSUNG,
+                         0x412A),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
                          PCI_VENDOR_ID_ATHEROS,
                          0x3027),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
@@ -586,10 +616,25 @@ static const struct pci_device_id ath_pci_id_table[] = {
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
                          0x11AD, /* LITEON */
+                         0x1832),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
                          0x0692),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
+                         0x11AD, /* LITEON */
+                         0x0803),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
+                         0x0813),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
                          PCI_VENDOR_ID_AZWAVE,
                          0x2130),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
@@ -605,6 +650,21 @@ static const struct pci_device_id ath_pci_id_table[] = {
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x218B),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x218C),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x2F82),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
                          0x144F, /* ASKEY */
                          0x7202),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
@@ -616,10 +676,20 @@ static const struct pci_device_id ath_pci_id_table[] = {
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
                          0x1B9A, /* XAVI */
+                         0x2813),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x1B9A, /* XAVI */
                          0x28A2),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
+                         0x1B9A, /* XAVI */
+                         0x28A4),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
                          0x185F, /* WNC */
                          0x3027),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
@@ -636,10 +706,25 @@ static const struct pci_device_id ath_pci_id_table[] = {
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
                          PCI_VENDOR_ID_FOXCONN,
+                         0xE08F),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_FOXCONN,
                          0xE081),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
+                         PCI_VENDOR_ID_FOXCONN,
+                         0xE091),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_FOXCONN,
+                         0xE099),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
                          PCI_VENDOR_ID_LENOVO,
                          0x3026),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
@@ -913,9 +998,12 @@ static int ath_pci_suspend(struct device *device)
         struct pci_dev *pdev = to_pci_dev(device);
         struct ieee80211_hw *hw = pci_get_drvdata(pdev);
         struct ath_softc *sc = hw->priv;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
 
-        if (sc->wow_enabled)
+        if (test_bit(ATH_OP_WOW_ENABLED, &common->op_flags)) {
+                dev_info(&pdev->dev, "WOW is enabled, bypassing PCI suspend\n");
                 return 0;
+        }
 
         /* The device has to be moved to FULLSLEEP forcibly.
          * Otherwise the chip never moved to full sleep,
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 7395afbc5124..6fb40ef86fd6 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -425,7 +425,8 @@ u32 ath_calcrxfilter(struct ath_softc *sc)
                 rfilt |= ATH9K_RX_FILTER_MCAST_BCAST_ALL;
         }
 
-        if (AR_SREV_9550(sc->sc_ah) || AR_SREV_9531(sc->sc_ah))
+        if (AR_SREV_9550(sc->sc_ah) || AR_SREV_9531(sc->sc_ah) ||
+            AR_SREV_9561(sc->sc_ah))
                 rfilt |= ATH9K_RX_FILTER_4ADDRESS;
 
         if (ath9k_is_chanctx_enabled() &&
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index fb11a9172f38..9587ec655680 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -814,6 +814,7 @@
 #define AR_SREV_REVISION_9531_10        0
 #define AR_SREV_REVISION_9531_11        1
 #define AR_SREV_REVISION_9531_20        2
+#define AR_SREV_VERSION_9561            0x600
 
 #define AR_SREV_5416(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_5416_PCI) || \
@@ -899,10 +900,13 @@
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9485))
 #define AR_SREV_9565(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9565))
+#define AR_SREV_9003_PCOEM(_ah) \
+        (AR_SREV_9462(_ah) || AR_SREV_9485(_ah) || AR_SREV_9565(_ah))
 #else
 #define AR_SREV_9462(_ah) 0
 #define AR_SREV_9485(_ah) 0
 #define AR_SREV_9565(_ah) 0
+#define AR_SREV_9003_PCOEM(_ah) 0
 #endif
 
 #define AR_SREV_9485_11_OR_LATER(_ah) \
@@ -974,6 +978,9 @@
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9531) && \
          ((_ah)->hw_version.macRev == AR_SREV_REVISION_9531_20))
 
+#define AR_SREV_9561(_ah) \
+        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9561))
+
 /* NOTE: When adding chips newer than Peacock, add chip check here */
 #define AR_SREV_9580_10_OR_LATER(_ah) \
         (AR_SREV_9580(_ah))
@@ -1876,6 +1883,7 @@ enum {
 #define AR_FIRST_NDP_TIMER                  7
 #define AR_NDP2_PERIOD                      0x81a0
 #define AR_NDP2_TIMER_MODE                  0x81c0
+#define AR_GEN_TIMERS2_MODE_ENABLE_MASK     0x000000FF
 
 #define AR_GEN_TIMERS(_i)                   (0x8200 + ((_i) << 2))
 #define AR_NEXT_TBTT_TIMER                  AR_GEN_TIMERS(0)
@@ -1971,6 +1979,7 @@ enum {
 
 #define AR_DIRECT_CONNECT                              0x83a0
 #define AR_DC_AP_STA_EN                                0x00000001
+#define AR_DC_TSF2_ENABLE                              0x00000001
 
 #define AR_AES_MUTE_MASK0       0x805c
 #define AR_AES_MUTE_MASK0_FC    0x0000FFFF
@@ -2003,126 +2012,6 @@ enum {
 
 #define AR_WOW_BEACON_TIMO_MAX          0xffffffff
 
-/*
- * MAC WoW Registers
- */
-
-#define AR_WOW_PATTERN                  0x825C
-#define AR_WOW_COUNT                    0x8260
-#define AR_WOW_BCN_EN                   0x8270
-#define AR_WOW_BCN_TIMO                 0x8274
-#define AR_WOW_KEEP_ALIVE_TIMO          0x8278
-#define AR_WOW_KEEP_ALIVE               0x827c
-#define AR_WOW_US_SCALAR                0x8284
-#define AR_WOW_KEEP_ALIVE_DELAY         0x8288
-#define AR_WOW_PATTERN_MATCH            0x828c
-#define AR_WOW_PATTERN_OFF1             0x8290  /* pattern bytes 0 -> 3 */
-#define AR_WOW_PATTERN_OFF2             0x8294  /* pattern bytes 4 -> 7 */
-
-/* for AR9285 or later version of chips */
-#define AR_WOW_EXACT                    0x829c
-#define AR_WOW_LENGTH1                  0x8360
-#define AR_WOW_LENGTH2                  0X8364
-/* register to enable match for less than 256 bytes packets */
-#define AR_WOW_PATTERN_MATCH_LT_256B    0x8368
-
-#define AR_SW_WOW_CONTROL               0x20018
-#define AR_SW_WOW_ENABLE                0x1
-#define AR_SWITCH_TO_REFCLK             0x2
-#define AR_RESET_CONTROL                0x4
-#define AR_RESET_VALUE_MASK             0x8
-#define AR_HW_WOW_DISABLE               0x10
-#define AR_CLR_MAC_INTERRUPT            0x20
-#define AR_CLR_KA_INTERRUPT             0x40
-
-/* AR_WOW_PATTERN register values */
-#define AR_WOW_BACK_OFF_SHIFT(x)        ((x & 0xf) << 28) /* in usecs */
-#define AR_WOW_MAC_INTR_EN              0x00040000
-#define AR_WOW_MAGIC_EN                 0x00010000
-#define AR_WOW_PATTERN_EN(x)            (x & 0xff)
-#define AR_WOW_PAT_FOUND_SHIFT  8
-#define AR_WOW_PATTERN_FOUND(x)         (x & (0xff << AR_WOW_PAT_FOUND_SHIFT))
-#define AR_WOW_PATTERN_FOUND_MASK       ((0xff) << AR_WOW_PAT_FOUND_SHIFT)
-#define AR_WOW_MAGIC_PAT_FOUND          0x00020000
-#define AR_WOW_MAC_INTR                 0x00080000
-#define AR_WOW_KEEP_ALIVE_FAIL          0x00100000
-#define AR_WOW_BEACON_FAIL              0x00200000
-
-#define AR_WOW_STATUS(x)                (x & (AR_WOW_PATTERN_FOUND_MASK | \
-                                              AR_WOW_MAGIC_PAT_FOUND    | \
-                                              AR_WOW_KEEP_ALIVE_FAIL    | \
-                                              AR_WOW_BEACON_FAIL))
-#define AR_WOW_CLEAR_EVENTS(x)          (x & ~(AR_WOW_PATTERN_EN(0xff) | \
-                                               AR_WOW_MAGIC_EN | \
-                                               AR_WOW_MAC_INTR_EN | \
-                                               AR_WOW_BEACON_FAIL | \
-                                               AR_WOW_KEEP_ALIVE_FAIL))
-
-/* AR_WOW_COUNT register values */
-#define AR_WOW_AIFS_CNT(x)              (x & 0xff)
-#define AR_WOW_SLOT_CNT(x)              ((x & 0xff) << 8)
-#define AR_WOW_KEEP_ALIVE_CNT(x)        ((x & 0xff) << 16)
-
-/* AR_WOW_BCN_EN register */
-#define AR_WOW_BEACON_FAIL_EN           0x00000001
-
-/* AR_WOW_BCN_TIMO rgister */
-#define AR_WOW_BEACON_TIMO              0x40000000 /* valid if BCN_EN is set */
-
-/* AR_WOW_KEEP_ALIVE_TIMO register */
-#define AR_WOW_KEEP_ALIVE_TIMO_VALUE
-#define AR_WOW_KEEP_ALIVE_NEVER         0xffffffff
-
-/* AR_WOW_KEEP_ALIVE register  */
-#define AR_WOW_KEEP_ALIVE_AUTO_DIS      0x00000001
-#define AR_WOW_KEEP_ALIVE_FAIL_DIS      0x00000002
-
-/* AR_WOW_KEEP_ALIVE_DELAY register */
-#define AR_WOW_KEEP_ALIVE_DELAY_VALUE   0x000003e8 /* 1 msec */
-
-
-/*
- * keep it long for beacon workaround - ensure no false alarm
- */
-#define AR_WOW_BMISSTHRESHOLD           0x20
-
-/* AR_WOW_PATTERN_MATCH register */
-#define AR_WOW_PAT_END_OF_PKT(x)        (x & 0xf)
-#define AR_WOW_PAT_OFF_MATCH(x)         ((x & 0xf) << 8)
-
-/*
- * default values for Wow Configuration for backoff, aifs, slot, keep-alive
- * to be programmed into various registers.
- */
-#define AR_WOW_PAT_BACKOFF      0x00000004 /* AR_WOW_PATTERN_REG */
-#define AR_WOW_CNT_AIFS_CNT     0x00000022 /* AR_WOW_COUNT_REG */
-#define AR_WOW_CNT_SLOT_CNT     0x00000009 /* AR_WOW_COUNT_REG */
-/*
- * Keepalive count applicable for AR9280 2.0 and above.
- */
-#define AR_WOW_CNT_KA_CNT 0x00000008    /* AR_WOW_COUNT register */
-
-/* WoW - Transmit buffer for keep alive frames */
-#define AR_WOW_TRANSMIT_BUFFER  0xe000 /* E000 - EFFC */
-
-#define AR_WOW_TXBUF(i)         (AR_WOW_TRANSMIT_BUFFER + ((i) << 2))
-
-#define AR_WOW_KA_DESC_WORD2    0xe000
-
-#define AR_WOW_KA_DATA_WORD0    0xe030
-
-/* WoW Transmit Buffer for patterns */
-#define AR_WOW_TB_PATTERN(i)    (0xe100 + (i << 8))
-#define AR_WOW_TB_MASK(i)       (0xec00 + (i << 5))
-
-/* Currently Pattern 0-7 are supported - so bit 0-7 are set */
-#define AR_WOW_PATTERN_SUPPORTED        0xff
-#define AR_WOW_LENGTH_MAX               0xff
-#define AR_WOW_LEN1_SHIFT(_i)   ((0x3 - ((_i) & 0x3)) << 0x3)
-#define AR_WOW_LENGTH1_MASK(_i) (AR_WOW_LENGTH_MAX << AR_WOW_LEN1_SHIFT(_i))
-#define AR_WOW_LEN2_SHIFT(_i)   ((0x7 - ((_i) & 0x7)) << 0x3)
-#define AR_WOW_LENGTH2_MASK(_i) (AR_WOW_LENGTH_MAX << AR_WOW_LEN2_SHIFT(_i))
-
 #define AR9271_CORE_CLOCK       117   /* clock to 117Mhz */
 #define AR9271_TARGET_BAUD_RATE 19200 /* 115200 */
 
diff --git a/drivers/net/wireless/ath/ath9k/reg_wow.h b/drivers/net/wireless/ath/ath9k/reg_wow.h
new file mode 100644
index 000000000000..3abfca56ca58
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/reg_wow.h
@@ -0,0 +1,128 @@
+/*
+ * Copyright (c) 2015 Qualcomm Atheros Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef REG_WOW_H
+#define REG_WOW_H
+
+#define AR_WOW_PATTERN                  0x825C
+#define AR_WOW_COUNT                    0x8260
+#define AR_WOW_BCN_EN                   0x8270
+#define AR_WOW_BCN_TIMO                 0x8274
+#define AR_WOW_KEEP_ALIVE_TIMO          0x8278
+#define AR_WOW_KEEP_ALIVE               0x827c
+#define AR_WOW_KEEP_ALIVE_DELAY         0x8288
+#define AR_WOW_PATTERN_MATCH            0x828c
+
+/*
+ * AR_WOW_LENGTH1
+ * bit 31:24 pattern 0 length
+ * bit 23:16 pattern 1 length
+ * bit 15:8 pattern 2 length
+ * bit 7:0 pattern 3 length
+ *
+ * AR_WOW_LENGTH2
+ * bit 31:24 pattern 4 length
+ * bit 23:16 pattern 5 length
+ * bit 15:8 pattern 6 length
+ * bit 7:0 pattern 7 length
+ *
+ * AR_WOW_LENGTH3
+ * bit 31:24 pattern 8 length
+ * bit 23:16 pattern 9 length
+ * bit 15:8 pattern 10 length
+ * bit 7:0 pattern 11 length
+ *
+ * AR_WOW_LENGTH4
+ * bit 31:24 pattern 12 length
+ * bit 23:16 pattern 13 length
+ * bit 15:8 pattern 14 length
+ * bit 7:0 pattern 15 length
+ */
+#define AR_WOW_LENGTH1                  0x8360
+#define AR_WOW_LENGTH2                  0X8364
+#define AR_WOW_LENGTH3                  0X8380
+#define AR_WOW_LENGTH4                  0X8384
+
+#define AR_WOW_PATTERN_MATCH_LT_256B    0x8368
+#define AR_MAC_PCU_WOW4                 0x8370
+
+#define AR_SW_WOW_CONTROL               0x20018
+#define AR_SW_WOW_ENABLE                0x1
+#define AR_SWITCH_TO_REFCLK             0x2
+#define AR_RESET_CONTROL                0x4
+#define AR_RESET_VALUE_MASK             0x8
+#define AR_HW_WOW_DISABLE               0x10
+#define AR_CLR_MAC_INTERRUPT            0x20
+#define AR_CLR_KA_INTERRUPT             0x40
+
+#define AR_WOW_BACK_OFF_SHIFT(x)        ((x & 0xf) << 27) /* in usecs */
+#define AR_WOW_MAC_INTR_EN              0x00040000
+#define AR_WOW_MAGIC_EN                 0x00010000
+#define AR_WOW_PATTERN_EN(x)            (x & 0xff)
+#define AR_WOW_PAT_FOUND_SHIFT  8
+#define AR_WOW_PATTERN_FOUND(x)         (x & (0xff << AR_WOW_PAT_FOUND_SHIFT))
+#define AR_WOW_PATTERN_FOUND_MASK       ((0xff) << AR_WOW_PAT_FOUND_SHIFT)
+#define AR_WOW_MAGIC_PAT_FOUND          0x00020000
+#define AR_WOW_MAC_INTR                 0x00080000
+#define AR_WOW_KEEP_ALIVE_FAIL          0x00100000
+#define AR_WOW_BEACON_FAIL              0x00200000
+
+#define AR_WOW_STATUS(x)                (x & (AR_WOW_PATTERN_FOUND_MASK | \
+                                              AR_WOW_MAGIC_PAT_FOUND    | \
+                                              AR_WOW_KEEP_ALIVE_FAIL    | \
+                                              AR_WOW_BEACON_FAIL))
+#define AR_WOW_CLEAR_EVENTS(x)          (x & ~(AR_WOW_PATTERN_EN(0xff) | \
+                                               AR_WOW_MAGIC_EN |        \
+                                               AR_WOW_MAC_INTR_EN |     \
+                                               AR_WOW_BEACON_FAIL |     \
+                                               AR_WOW_KEEP_ALIVE_FAIL))
+
+#define AR_WOW_AIFS_CNT(x)              (x & 0xff)
+#define AR_WOW_SLOT_CNT(x)              ((x & 0xff) << 8)
+#define AR_WOW_KEEP_ALIVE_CNT(x)        ((x & 0xff) << 16)
+
+#define AR_WOW_BEACON_FAIL_EN           0x00000001
+#define AR_WOW_BEACON_TIMO              0x40000000
+#define AR_WOW_KEEP_ALIVE_NEVER         0xffffffff
+#define AR_WOW_KEEP_ALIVE_AUTO_DIS      0x00000001
+#define AR_WOW_KEEP_ALIVE_FAIL_DIS      0x00000002
+#define AR_WOW_KEEP_ALIVE_DELAY_VALUE   0x000003e8 /* 1 msec */
+#define AR_WOW_BMISSTHRESHOLD           0x20
+#define AR_WOW_PAT_END_OF_PKT(x)        (x & 0xf)
+#define AR_WOW_PAT_OFF_MATCH(x)         ((x & 0xf) << 8)
+#define AR_WOW_PAT_BACKOFF              0x00000004
+#define AR_WOW_CNT_AIFS_CNT             0x00000022
+#define AR_WOW_CNT_SLOT_CNT             0x00000009
+#define AR_WOW_CNT_KA_CNT               0x00000008
+
+#define AR_WOW_TRANSMIT_BUFFER          0xe000
+#define AR_WOW_TXBUF(i)                 (AR_WOW_TRANSMIT_BUFFER + ((i) << 2))
+#define AR_WOW_KA_DESC_WORD2            0xe000
+#define AR_WOW_TB_PATTERN(i)            (0xe100 + (i << 8))
+#define AR_WOW_TB_MASK(i)               (0xec00 + (i << 5))
+#define AR_WOW_PATTERN_SUPPORTED_LEGACY 0xff
+#define AR_WOW_PATTERN_SUPPORTED        0xffff
+#define AR_WOW_LENGTH_MAX               0xff
+#define AR_WOW_LEN1_SHIFT(_i)           ((0x3 - ((_i) & 0x3)) << 0x3)
+#define AR_WOW_LENGTH1_MASK(_i)         (AR_WOW_LENGTH_MAX << AR_WOW_LEN1_SHIFT(_i))
+#define AR_WOW_LEN2_SHIFT(_i)           ((0x7 - ((_i) & 0x7)) << 0x3)
+#define AR_WOW_LENGTH2_MASK(_i)         (AR_WOW_LENGTH_MAX << AR_WOW_LEN2_SHIFT(_i))
+#define AR_WOW_LEN3_SHIFT(_i)           ((0xb - ((_i) & 0xb)) << 0x3)
+#define AR_WOW_LENGTH3_MASK(_i)         (AR_WOW_LENGTH_MAX << AR_WOW_LEN3_SHIFT(_i))
+#define AR_WOW_LEN4_SHIFT(_i)           ((0xf - ((_i) & 0xf)) << 0x3)
+#define AR_WOW_LENGTH4_MASK(_i)         (AR_WOW_LENGTH_MAX << AR_WOW_LEN4_SHIFT(_i))
+
+#endif /* REG_WOW_H */
diff --git a/drivers/net/wireless/ath/ath9k/wow.c b/drivers/net/wireless/ath/ath9k/wow.c
index 5f30e580d942..8d0b1730a9d5 100644
--- a/drivers/net/wireless/ath/ath9k/wow.c
+++ b/drivers/net/wireless/ath/ath9k/wow.c
@@ -16,36 +16,43 @@
 
 #include "ath9k.h"
 
-static const struct wiphy_wowlan_support ath9k_wowlan_support = {
+static const struct wiphy_wowlan_support ath9k_wowlan_support_legacy = {
         .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
         .n_patterns = MAX_NUM_USER_PATTERN,
         .pattern_min_len = 1,
         .pattern_max_len = MAX_PATTERN_SIZE,
 };
 
-static void ath9k_wow_map_triggers(struct ath_softc *sc,
-                                   struct cfg80211_wowlan *wowlan,
-                                   u32 *wow_triggers)
+static const struct wiphy_wowlan_support ath9k_wowlan_support = {
+        .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
+        .n_patterns = MAX_NUM_PATTERN - 2,
+        .pattern_min_len = 1,
+        .pattern_max_len = MAX_PATTERN_SIZE,
+};
+
+static u8 ath9k_wow_map_triggers(struct ath_softc *sc,
+                                 struct cfg80211_wowlan *wowlan)
 {
+        u8 wow_triggers = 0;
+
         if (wowlan->disconnect)
-                *wow_triggers |= AH_WOW_LINK_CHANGE |
-                                 AH_WOW_BEACON_MISS;
+                wow_triggers |= AH_WOW_LINK_CHANGE |
+                                AH_WOW_BEACON_MISS;
         if (wowlan->magic_pkt)
-                *wow_triggers |= AH_WOW_MAGIC_PATTERN_EN;
+                wow_triggers |= AH_WOW_MAGIC_PATTERN_EN;
 
         if (wowlan->n_patterns)
-                *wow_triggers |= AH_WOW_USER_PATTERN_EN;
-
-        sc->wow_enabled = *wow_triggers;
+                wow_triggers |= AH_WOW_USER_PATTERN_EN;
 
+        return wow_triggers;
 }
 
-static void ath9k_wow_add_disassoc_deauth_pattern(struct ath_softc *sc)
+static int ath9k_wow_add_disassoc_deauth_pattern(struct ath_softc *sc)
 {
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
         int pattern_count = 0;
-        int i, byte_cnt;
+        int ret, i, byte_cnt = 0;
         u8 dis_deauth_pattern[MAX_PATTERN_SIZE];
         u8 dis_deauth_mask[MAX_PATTERN_SIZE];
 
@@ -80,12 +87,7 @@ static void ath9k_wow_add_disassoc_deauth_pattern(struct ath_softc *sc)
          *                          | x:x:x:x:x:x  -- 22 bytes
          */
 
-        /* Create Disassociate Pattern first */
-
-        byte_cnt = 0;
-
         /* Fill out the mask with all FF's */
-
         for (i = 0; i < MAX_PATTERN_MASK_SIZE; i++)
                 dis_deauth_mask[i] = 0xff;
 
@@ -108,19 +110,17 @@ static void ath9k_wow_add_disassoc_deauth_pattern(struct ath_softc *sc)
         byte_cnt += 6;
 
         /* copy the bssid, its same as the source mac address */
-
         memcpy((dis_deauth_pattern + byte_cnt), common->curbssid, ETH_ALEN);
 
         /* Create Disassociate pattern mask */
-
         dis_deauth_mask[0] = 0xfe;
         dis_deauth_mask[1] = 0x03;
         dis_deauth_mask[2] = 0xc0;
 
-        ath_dbg(common, WOW, "Adding disassoc/deauth patterns for WoW\n");
-
-        ath9k_hw_wow_apply_pattern(ah, dis_deauth_pattern, dis_deauth_mask,
-                                   pattern_count, byte_cnt);
+        ret = ath9k_hw_wow_apply_pattern(ah, dis_deauth_pattern, dis_deauth_mask,
+                                         pattern_count, byte_cnt);
+        if (ret)
+                goto exit;
 
         pattern_count++;
         /*
@@ -129,59 +129,39 @@ static void ath9k_wow_add_disassoc_deauth_pattern(struct ath_softc *sc)
          */
         dis_deauth_pattern[0] = 0xC0;
 
-        ath9k_hw_wow_apply_pattern(ah, dis_deauth_pattern, dis_deauth_mask,
-                                   pattern_count, byte_cnt);
-
+        ret = ath9k_hw_wow_apply_pattern(ah, dis_deauth_pattern, dis_deauth_mask,
+                                         pattern_count, byte_cnt);
+exit:
+        return ret;
 }
 
-static void ath9k_wow_add_pattern(struct ath_softc *sc,
-                                  struct cfg80211_wowlan *wowlan)
+static int ath9k_wow_add_pattern(struct ath_softc *sc,
+                                 struct cfg80211_wowlan *wowlan)
 {
         struct ath_hw *ah = sc->sc_ah;
-        struct ath9k_wow_pattern *wow_pattern = NULL;
         struct cfg80211_pkt_pattern *patterns = wowlan->patterns;
-        int mask_len;
+        u8 wow_pattern[MAX_PATTERN_SIZE];
+        u8 wow_mask[MAX_PATTERN_SIZE];
+        int mask_len, ret = 0;
         s8 i = 0;
 
-        if (!wowlan->n_patterns)
-                return;
-
-        /*
-         * Add the new user configured patterns
-         */
         for (i = 0; i < wowlan->n_patterns; i++) {
-
-                wow_pattern = kzalloc(sizeof(*wow_pattern), GFP_KERNEL);
-
-                if (!wow_pattern)
-                        return;
-
-                /*
-                 * TODO: convert the generic user space pattern to
-                 * appropriate chip specific/802.11 pattern.
-                 */
-
-                mask_len = DIV_ROUND_UP(wowlan->patterns[i].pattern_len, 8);
-                memset(wow_pattern->pattern_bytes, 0, MAX_PATTERN_SIZE);
-                memset(wow_pattern->mask_bytes, 0, MAX_PATTERN_SIZE);
-                memcpy(wow_pattern->pattern_bytes, patterns[i].pattern,
-                       patterns[i].pattern_len);
-                memcpy(wow_pattern->mask_bytes, patterns[i].mask, mask_len);
-                wow_pattern->pattern_len = patterns[i].pattern_len;
-
-                /*
-                 * just need to take care of deauth and disssoc pattern,
-                 * make sure we don't overwrite them.
-                 */
-
-                ath9k_hw_wow_apply_pattern(ah, wow_pattern->pattern_bytes,
-                                           wow_pattern->mask_bytes,
-                                           i + 2,
-                                           wow_pattern->pattern_len);
-                kfree(wow_pattern);
-
+                mask_len = DIV_ROUND_UP(patterns[i].pattern_len, 8);
+                memset(wow_pattern, 0, MAX_PATTERN_SIZE);
+                memset(wow_mask, 0, MAX_PATTERN_SIZE);
+                memcpy(wow_pattern, patterns[i].pattern, patterns[i].pattern_len);
+                memcpy(wow_mask, patterns[i].mask, mask_len);
+
+                ret = ath9k_hw_wow_apply_pattern(ah,
+                                                 wow_pattern,
+                                                 wow_mask,
+                                                 i + 2,
+                                                 patterns[i].pattern_len);
+                if (ret)
+                        break;
         }
 
+        return ret;
 }
 
 int ath9k_suspend(struct ieee80211_hw *hw,
@@ -190,41 +170,39 @@ int ath9k_suspend(struct ieee80211_hw *hw,
         struct ath_softc *sc = hw->priv;
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
-        u32 wow_triggers_enabled = 0;
+        u8 triggers;
         int ret = 0;
 
         ath9k_deinit_channel_context(sc);
 
         mutex_lock(&sc->mutex);
 
-        ath_cancel_work(sc);
-        ath_stop_ani(sc);
-
         if (test_bit(ATH_OP_INVALID, &common->op_flags)) {
-                ath_dbg(common, ANY, "Device not present\n");
-                ret = -EINVAL;
+                ath_err(common, "Device not present\n");
+                ret = -ENODEV;
                 goto fail_wow;
         }
 
         if (WARN_ON(!wowlan)) {
-                ath_dbg(common, WOW, "None of the WoW triggers enabled\n");
+                ath_err(common, "None of the WoW triggers enabled\n");
                 ret = -EINVAL;
                 goto fail_wow;
         }
 
-        if (!device_can_wakeup(sc->dev)) {
-                ath_dbg(common, WOW, "device_can_wakeup failed, WoW is not enabled\n");
+        if (sc->cur_chan->nvifs > 1) {
+                ath_dbg(common, WOW, "WoW for multivif is not yet supported\n");
                 ret = 1;
                 goto fail_wow;
         }
 
-        /*
-         * none of the sta vifs are associated
-         * and we are not currently handling multivif
-         * cases, for instance we have to seperately
-         * configure 'keep alive frame' for each
-         * STA.
-         */
+        if (ath9k_is_chanctx_enabled()) {
+                if (test_bit(ATH_OP_MULTI_CHANNEL, &common->op_flags)) {
+                        ath_dbg(common, WOW,
+                                "Multi-channel WOW is not supported\n");
+                        ret = 1;
+                        goto fail_wow;
+                }
+        }
 
         if (!test_bit(ATH_OP_PRIM_STA_VIF, &common->op_flags)) {
                 ath_dbg(common, WOW, "None of the STA vifs are associated\n");
@@ -232,16 +210,15 @@ int ath9k_suspend(struct ieee80211_hw *hw,
                 goto fail_wow;
         }
 
-        if (sc->cur_chan->nvifs > 1) {
-                ath_dbg(common, WOW, "WoW for multivif is not yet supported\n");
+        triggers = ath9k_wow_map_triggers(sc, wowlan);
+        if (!triggers) {
+                ath_dbg(common, WOW, "No valid WoW triggers\n");
                 ret = 1;
                 goto fail_wow;
         }
 
-        ath9k_wow_map_triggers(sc, wowlan, &wow_triggers_enabled);
-
-        ath_dbg(common, WOW, "WoW triggers enabled 0x%x\n",
-                wow_triggers_enabled);
+        ath_cancel_work(sc);
+        ath_stop_ani(sc);
 
         ath9k_ps_wakeup(sc);
 
@@ -251,10 +228,21 @@ int ath9k_suspend(struct ieee80211_hw *hw,
          * Enable wake up on recieving disassoc/deauth
          * frame by default.
          */
-        ath9k_wow_add_disassoc_deauth_pattern(sc);
+        ret = ath9k_wow_add_disassoc_deauth_pattern(sc);
+        if (ret) {
+                ath_err(common,
+                        "Unable to add disassoc/deauth pattern: %d\n", ret);
+                goto fail_wow;
+        }
 
-        if (wow_triggers_enabled & AH_WOW_USER_PATTERN_EN)
-                ath9k_wow_add_pattern(sc, wowlan);
+        if (triggers & AH_WOW_USER_PATTERN_EN) {
+                ret = ath9k_wow_add_pattern(sc, wowlan);
+                if (ret) {
+                        ath_err(common,
+                                "Unable to add user pattern: %d\n", ret);
+                        goto fail_wow;
+                }
+        }
 
         spin_lock_bh(&sc->sc_pcu_lock);
         /*
@@ -278,12 +266,12 @@ int ath9k_suspend(struct ieee80211_hw *hw,
         synchronize_irq(sc->irq);
         tasklet_kill(&sc->intr_tq);
 
-        ath9k_hw_wow_enable(ah, wow_triggers_enabled);
+        ath9k_hw_wow_enable(ah, triggers);
 
         ath9k_ps_restore(sc);
-        ath_dbg(common, ANY, "WoW enabled in ath9k\n");
-        atomic_inc(&sc->wow_sleep_proc_intr);
+        ath_dbg(common, WOW, "Suspend with WoW triggers: 0x%x\n", triggers);
 
+        set_bit(ATH_OP_WOW_ENABLED, &common->op_flags);
 fail_wow:
         mutex_unlock(&sc->mutex);
         return ret;
@@ -294,7 +282,7 @@ int ath9k_resume(struct ieee80211_hw *hw)
         struct ath_softc *sc = hw->priv;
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
-        u32 wow_status;
+        u8 status;
 
         mutex_lock(&sc->mutex);
 
@@ -309,29 +297,14 @@ int ath9k_resume(struct ieee80211_hw *hw)
 
         spin_unlock_bh(&sc->sc_pcu_lock);
 
-        wow_status = ath9k_hw_wow_wakeup(ah);
-
-        if (atomic_read(&sc->wow_got_bmiss_intr) == 0) {
-                /*
-                 * some devices may not pick beacon miss
-                 * as the reason they woke up so we add
-                 * that here for that shortcoming.
-                 */
-                wow_status |= AH_WOW_BEACON_MISS;
-                atomic_dec(&sc->wow_got_bmiss_intr);
-                ath_dbg(common, ANY, "Beacon miss interrupt picked up during WoW sleep\n");
-        }
-
-        atomic_dec(&sc->wow_sleep_proc_intr);
-
-        if (wow_status) {
-                ath_dbg(common, ANY, "Waking up due to WoW triggers %s with WoW status = %x\n",
-                        ath9k_hw_wow_event_to_string(wow_status), wow_status);
-        }
+        status = ath9k_hw_wow_wakeup(ah);
+        ath_dbg(common, WOW, "Resume with WoW status: 0x%x\n", status);
 
         ath_restart_work(sc);
         ath9k_start_btcoex(sc);
 
+        clear_bit(ATH_OP_WOW_ENABLED, &common->op_flags);
+
         ath9k_ps_restore(sc);
         mutex_unlock(&sc->mutex);
 
@@ -341,22 +314,35 @@ int ath9k_resume(struct ieee80211_hw *hw)
 void ath9k_set_wakeup(struct ieee80211_hw *hw, bool enabled)
 {
         struct ath_softc *sc = hw->priv;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
 
         mutex_lock(&sc->mutex);
-        device_init_wakeup(sc->dev, 1);
         device_set_wakeup_enable(sc->dev, enabled);
         mutex_unlock(&sc->mutex);
+
+        ath_dbg(common, WOW, "WoW wakeup source is %s\n",
+                (enabled) ? "enabled" : "disabled");
 }
 
 void ath9k_init_wow(struct ieee80211_hw *hw)
 {
         struct ath_softc *sc = hw->priv;
+        struct ath_hw *ah = sc->sc_ah;
+
+        if ((sc->driver_data & ATH9K_PCI_WOW) || sc->force_wow) {
+                if (AR_SREV_9462_20_OR_LATER(ah) || AR_SREV_9565_11_OR_LATER(ah))
+                        hw->wiphy->wowlan = &ath9k_wowlan_support;
+                else
+                        hw->wiphy->wowlan = &ath9k_wowlan_support_legacy;
 
-        if ((sc->sc_ah->caps.hw_caps & ATH9K_HW_WOW_DEVICE_CAPABLE) &&
-            (sc->driver_data & ATH9K_PCI_WOW) &&
-            device_can_wakeup(sc->dev))
-                hw->wiphy->wowlan = &ath9k_wowlan_support;
+                device_init_wakeup(sc->dev, 1);
+        }
+}
+
+void ath9k_deinit_wow(struct ieee80211_hw *hw)
+{
+        struct ath_softc *sc = hw->priv;
 
-        atomic_set(&sc->wow_sleep_proc_intr, -1);
-        atomic_set(&sc->wow_got_bmiss_intr, -1);
+        if ((sc->driver_data & ATH9K_PCI_WOW) || sc->force_wow)
+                device_init_wakeup(sc->dev, 0);
 }
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index e9bd02c2e844..1b8e75c4d2c2 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1097,24 +1097,65 @@ void ath_update_max_aggr_framelen(struct ath_softc *sc, int queue, int txop)
 }
 
 static u8 ath_get_rate_txpower(struct ath_softc *sc, struct ath_buf *bf,
-                               u8 rateidx)
+                               u8 rateidx, bool is_40, bool is_cck)
 {
         u8 max_power;
+        struct sk_buff *skb;
+        struct ath_frame_info *fi;
+        struct ieee80211_tx_info *info;
         struct ath_hw *ah = sc->sc_ah;
 
-        if (sc->tx99_state)
+        if (sc->tx99_state || !ah->tpc_enabled)
                 return MAX_RATE_POWER;
 
+        skb = bf->bf_mpdu;
+        fi = get_frame_info(skb);
+        info = IEEE80211_SKB_CB(skb);
+
         if (!AR_SREV_9300_20_OR_LATER(ah)) {
-                /* ar9002 is not sipported for the moment */
-                return MAX_RATE_POWER;
-        }
+                int txpower = fi->tx_power;
 
-        if (!bf->bf_state.bfs_paprd) {
-                struct sk_buff *skb = bf->bf_mpdu;
-                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-                struct ath_frame_info *fi = get_frame_info(skb);
+                if (is_40) {
+                        u8 power_ht40delta;
+                        struct ar5416_eeprom_def *eep = &ah->eeprom.def;
+
+                        if (AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_2) {
+                                bool is_2ghz;
+                                struct modal_eep_header *pmodal;
 
+                                is_2ghz = info->band == IEEE80211_BAND_2GHZ;
+                                pmodal = &eep->modalHeader[is_2ghz];
+                                power_ht40delta = pmodal->ht40PowerIncForPdadc;
+                        } else {
+                                power_ht40delta = 2;
+                        }
+                        txpower += power_ht40delta;
+                }
+
+                if (AR_SREV_9287(ah) || AR_SREV_9285(ah) ||
+                    AR_SREV_9271(ah)) {
+                        txpower -= 2 * AR9287_PWR_TABLE_OFFSET_DB;
+                } else if (AR_SREV_9280_20_OR_LATER(ah)) {
+                        s8 power_offset;
+
+                        power_offset = ah->eep_ops->get_eeprom(ah,
+                                                        EEP_PWR_TABLE_OFFSET);
+                        txpower -= 2 * power_offset;
+                }
+
+                if (OLC_FOR_AR9280_20_LATER && is_cck)
+                        txpower -= 2;
+
+                txpower = max(txpower, 0);
+                max_power = min_t(u8, ah->tx_power[rateidx], txpower);
+
+                /* XXX: clamp minimum TX power at 1 for AR9160 since if
+                 * max_power is set to 0, frames are transmitted at max
+                 * TX power
+                 */
+                if (!max_power && !AR_SREV_9280_20_OR_LATER(ah))
+                        max_power = 1;
+        } else if (!bf->bf_state.bfs_paprd) {
                 if (rateidx < 8 && (info->flags & IEEE80211_TX_CTL_STBC))
                         max_power = min(ah->tx_power_stbc[rateidx],
                                         fi->tx_power);
@@ -1152,7 +1193,7 @@ static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf,
         info->rtscts_rate = fi->rtscts_rate;
 
         for (i = 0; i < ARRAY_SIZE(bf->rates); i++) {
-                bool is_40, is_sgi, is_sp;
+                bool is_40, is_sgi, is_sp, is_cck;
                 int phy;
 
                 if (!rates[i].count || (rates[i].idx < 0))
@@ -1198,7 +1239,8 @@ static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf,
                         if (rix < 8 && (tx_info->flags & IEEE80211_TX_CTL_STBC))
                                 info->rates[i].RateFlags |= ATH9K_RATESERIES_STBC;
 
-                        info->txpower[i] = ath_get_rate_txpower(sc, bf, rix);
+                        info->txpower[i] = ath_get_rate_txpower(sc, bf, rix,
+                                                                is_40, false);
                         continue;
                 }
 
@@ -1227,7 +1269,9 @@ static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf,
                 info->rates[i].PktDuration = ath9k_hw_computetxtime(sc->sc_ah,
                         phy, rate->bitrate * 100, len, rix, is_sp);
 
-                info->txpower[i] = ath_get_rate_txpower(sc, bf, rix);
+                is_cck = IS_CCK_RATE(info->rates[i].Rate);
+                info->txpower[i] = ath_get_rate_txpower(sc, bf, rix, false,
+                                                        is_cck);
         }
 
         /* For AR5416 - RTS cannot be followed by a frame larger than 8K */
@@ -2259,7 +2303,7 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
         struct ath_txq *txq = txctl->txq;
         struct ath_atx_tid *tid = NULL;
         struct ath_buf *bf;
-        bool queue, skip_uapsd = false;
+        bool queue, skip_uapsd = false, ps_resp;
         int q, ret;
 
         if (vif)
@@ -2268,6 +2312,8 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
         if (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN)
                 txctl->force_channel = true;
 
+        ps_resp = !!(info->control.flags & IEEE80211_TX_CTRL_PS_RESPONSE);
+
         ret = ath_tx_prepare(hw, skb, txctl);
         if (ret)
             return ret;
@@ -2310,7 +2356,7 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
         if (txctl->an && queue)
                 tid = ath_get_skb_tid(sc, txctl->an, skb);
 
-        if (!skip_uapsd && (info->flags & IEEE80211_TX_CTL_PS_RESPONSE)) {
+        if (!skip_uapsd && ps_resp) {
                 ath_txq_unlock(sc, txq);
                 txq = sc->tx.uapsdq;
                 ath_txq_lock(sc, txq);
@@ -2443,9 +2489,12 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
         if (sc->sc_ah->caldata)
                 set_bit(PAPRD_PACKET_SENT, &sc->sc_ah->caldata->cal_flags);
 
-        if (!(tx_flags & ATH_TX_ERROR))
-                /* Frame was ACKed */
-                tx_info->flags |= IEEE80211_TX_STAT_ACK;
+        if (!(tx_flags & ATH_TX_ERROR)) {
+                if (tx_info->flags & IEEE80211_TX_CTL_NO_ACK)
+                        tx_info->flags |= IEEE80211_TX_STAT_NOACK_TRANSMITTED;
+                else
+                        tx_info->flags |= IEEE80211_TX_STAT_ACK;
+        }
 
         padpos = ieee80211_hdrlen(hdr->frame_control);
         padsize = padpos & 3;
diff --git a/drivers/net/wireless/ath/carl9170/cmd.c b/drivers/net/wireless/ath/carl9170/cmd.c
index 39a63874b275..f2b4f537e4c1 100644
--- a/drivers/net/wireless/ath/carl9170/cmd.c
+++ b/drivers/net/wireless/ath/carl9170/cmd.c
@@ -188,12 +188,12 @@ int carl9170_collect_tally(struct ar9170 *ar)
 
                 if (ar->channel) {
                         info = &ar->survey[ar->channel->hw_value];
-                        info->channel_time = ar->tally.active;
-                        info->channel_time_busy = ar->tally.cca;
-                        info->channel_time_tx = ar->tally.tx_time;
-                        do_div(info->channel_time, 1000);
-                        do_div(info->channel_time_busy, 1000);
-                        do_div(info->channel_time_tx, 1000);
+                        info->time = ar->tally.active;
+                        info->time_busy = ar->tally.cca;
+                        info->time_tx = ar->tally.tx_time;
+                        do_div(info->time, 1000);
+                        do_div(info->time_busy, 1000);
+                        do_div(info->time_tx, 1000);
                 }
         }
         return 0;
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index ef5b6dc7b7f1..f1455a04cb62 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -1690,9 +1690,9 @@ found:
                 survey->filled |= SURVEY_INFO_IN_USE;
 
         if (ar->fw.hw_counters) {
-                survey->filled |= SURVEY_INFO_CHANNEL_TIME |
-                                  SURVEY_INFO_CHANNEL_TIME_BUSY |
-                                  SURVEY_INFO_CHANNEL_TIME_TX;
+                survey->filled |= SURVEY_INFO_TIME |
+                                  SURVEY_INFO_TIME_BUSY |
+                                  SURVEY_INFO_TIME_TX;
         }
 
         return 0;
diff --git a/drivers/net/wireless/ath/dfs_pattern_detector.c b/drivers/net/wireless/ath/dfs_pattern_detector.c
index cfd0554cf140..3d57f8772389 100644
--- a/drivers/net/wireless/ath/dfs_pattern_detector.c
+++ b/drivers/net/wireless/ath/dfs_pattern_detector.c
@@ -86,7 +86,7 @@ static const struct radar_detector_specs fcc_radar_ref_types[] = {
         FCC_PATTERN(1, 0, 5, 150, 230, 1, 23),
         FCC_PATTERN(2, 6, 10, 200, 500, 1, 16),
         FCC_PATTERN(3, 11, 20, 200, 500, 1, 12),
-        FCC_PATTERN(4, 50, 100, 1000, 2000, 1, 20),
+        FCC_PATTERN(4, 50, 100, 1000, 2000, 1, 1),
         FCC_PATTERN(5, 0, 1, 333, 333, 1, 9),
 };
 
diff --git a/drivers/net/wireless/ath/wcn36xx/dxe.c b/drivers/net/wireless/ath/wcn36xx/dxe.c
index 73f12f196f14..086549b732b9 100644
--- a/drivers/net/wireless/ath/wcn36xx/dxe.c
+++ b/drivers/net/wireless/ath/wcn36xx/dxe.c
@@ -84,6 +84,7 @@ static int wcn36xx_dxe_allocate_ctl_block(struct wcn36xx_dxe_ch *ch)
                 if (!cur_ctl)
                         goto out_fail;
 
+                spin_lock_init(&cur_ctl->skb_lock);
                 cur_ctl->ctl_blk_order = i;
                 if (i == 0) {
                         ch->head_blk_ctl = cur_ctl;
@@ -354,6 +355,8 @@ static void reap_tx_dxes(struct wcn36xx *wcn, struct wcn36xx_dxe_ch *ch)
          * and while-do will not make any cycles.
          */
         do {
+                if (ctl->desc->ctrl & WCN36XX_DXE_CTRL_VALID_MASK)
+                        break;
                 if (ctl->skb) {
                         dma_unmap_single(NULL, ctl->desc->src_addr_l,
                                          ctl->skb->len, DMA_TO_DEVICE);
diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
index 7dd8873f757e..0783d2ed8238 100644
--- a/drivers/net/wireless/ath/wcn36xx/main.c
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -298,6 +298,8 @@ static int wcn36xx_start(struct ieee80211_hw *hw)
         wcn36xx_debugfs_init(wcn);
 
         INIT_LIST_HEAD(&wcn->vif_list);
+        spin_lock_init(&wcn->dxe_lock);
+
         return 0;
 
 out_smd_stop:
@@ -795,6 +797,7 @@ static int wcn36xx_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
         wcn36xx_dbg(WCN36XX_DBG_MAC, "mac sta add vif %p sta %pM\n",
                     vif, sta->addr);
 
+        spin_lock_init(&sta_priv->ampdu_lock);
         vif_priv->sta = sta_priv;
         sta_priv->vif = vif_priv;
         /*
@@ -873,21 +876,32 @@ static int wcn36xx_ampdu_action(struct ieee80211_hw *hw,
                         get_sta_index(vif, sta_priv));
                 wcn36xx_smd_add_ba(wcn);
                 wcn36xx_smd_trigger_ba(wcn, get_sta_index(vif, sta_priv));
-                ieee80211_start_tx_ba_session(sta, tid, 0);
                 break;
         case IEEE80211_AMPDU_RX_STOP:
                 wcn36xx_smd_del_ba(wcn, tid, get_sta_index(vif, sta_priv));
                 break;
         case IEEE80211_AMPDU_TX_START:
+                spin_lock_bh(&sta_priv->ampdu_lock);
+                sta_priv->ampdu_state[tid] = WCN36XX_AMPDU_START;
+                spin_unlock_bh(&sta_priv->ampdu_lock);
+
                 ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
                 break;
         case IEEE80211_AMPDU_TX_OPERATIONAL:
+                spin_lock_bh(&sta_priv->ampdu_lock);
+                sta_priv->ampdu_state[tid] = WCN36XX_AMPDU_OPERATIONAL;
+                spin_unlock_bh(&sta_priv->ampdu_lock);
+
                 wcn36xx_smd_add_ba_session(wcn, sta, tid, ssn, 1,
                         get_sta_index(vif, sta_priv));
                 break;
         case IEEE80211_AMPDU_TX_STOP_FLUSH:
         case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
         case IEEE80211_AMPDU_TX_STOP_CONT:
+                spin_lock_bh(&sta_priv->ampdu_lock);
+                sta_priv->ampdu_state[tid] = WCN36XX_AMPDU_NONE;
+                spin_unlock_bh(&sta_priv->ampdu_lock);
+
                 ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
                 break;
         default:
diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
index 63986931829e..69ed39731902 100644
--- a/drivers/net/wireless/ath/wcn36xx/smd.c
+++ b/drivers/net/wireless/ath/wcn36xx/smd.c
@@ -21,6 +21,61 @@
 #include <linux/bitops.h>
 #include "smd.h"
 
+struct wcn36xx_cfg_val {
+        u32 cfg_id;
+        u32 value;
+};
+
+#define WCN36XX_CFG_VAL(id, val) \
+{ \
+        .cfg_id = WCN36XX_HAL_CFG_ ## id, \
+        .value = val \
+}
+
+static struct wcn36xx_cfg_val wcn36xx_cfg_vals[] = {
+        WCN36XX_CFG_VAL(CURRENT_TX_ANTENNA, 1),
+        WCN36XX_CFG_VAL(CURRENT_RX_ANTENNA, 1),
+        WCN36XX_CFG_VAL(LOW_GAIN_OVERRIDE, 0),
+        WCN36XX_CFG_VAL(POWER_STATE_PER_CHAIN, 785),
+        WCN36XX_CFG_VAL(CAL_PERIOD, 5),
+        WCN36XX_CFG_VAL(CAL_CONTROL, 1),
+        WCN36XX_CFG_VAL(PROXIMITY, 0),
+        WCN36XX_CFG_VAL(NETWORK_DENSITY, 3),
+        WCN36XX_CFG_VAL(MAX_MEDIUM_TIME, 6000),
+        WCN36XX_CFG_VAL(MAX_MPDUS_IN_AMPDU, 64),
+        WCN36XX_CFG_VAL(RTS_THRESHOLD, 2347),
+        WCN36XX_CFG_VAL(SHORT_RETRY_LIMIT, 6),
+        WCN36XX_CFG_VAL(LONG_RETRY_LIMIT, 6),
+        WCN36XX_CFG_VAL(FRAGMENTATION_THRESHOLD, 8000),
+        WCN36XX_CFG_VAL(DYNAMIC_THRESHOLD_ZERO, 5),
+        WCN36XX_CFG_VAL(DYNAMIC_THRESHOLD_ONE, 10),
+        WCN36XX_CFG_VAL(DYNAMIC_THRESHOLD_TWO, 15),
+        WCN36XX_CFG_VAL(FIXED_RATE, 0),
+        WCN36XX_CFG_VAL(RETRYRATE_POLICY, 4),
+        WCN36XX_CFG_VAL(RETRYRATE_SECONDARY, 0),
+        WCN36XX_CFG_VAL(RETRYRATE_TERTIARY, 0),
+        WCN36XX_CFG_VAL(FORCE_POLICY_PROTECTION, 5),
+        WCN36XX_CFG_VAL(FIXED_RATE_MULTICAST_24GHZ, 1),
+        WCN36XX_CFG_VAL(FIXED_RATE_MULTICAST_5GHZ, 5),
+        WCN36XX_CFG_VAL(DEFAULT_RATE_INDEX_5GHZ, 5),
+        WCN36XX_CFG_VAL(MAX_BA_SESSIONS, 40),
+        WCN36XX_CFG_VAL(PS_DATA_INACTIVITY_TIMEOUT, 200),
+        WCN36XX_CFG_VAL(PS_ENABLE_BCN_FILTER, 1),
+        WCN36XX_CFG_VAL(PS_ENABLE_RSSI_MONITOR, 1),
+        WCN36XX_CFG_VAL(NUM_BEACON_PER_RSSI_AVERAGE, 20),
+        WCN36XX_CFG_VAL(STATS_PERIOD, 10),
+        WCN36XX_CFG_VAL(CFP_MAX_DURATION, 30000),
+        WCN36XX_CFG_VAL(FRAME_TRANS_ENABLED, 0),
+        WCN36XX_CFG_VAL(BA_THRESHOLD_HIGH, 128),
+        WCN36XX_CFG_VAL(MAX_BA_BUFFERS, 2560),
+        WCN36XX_CFG_VAL(DYNAMIC_PS_POLL_VALUE, 0),
+        WCN36XX_CFG_VAL(TX_PWR_CTRL_ENABLE, 1),
+        WCN36XX_CFG_VAL(ENABLE_CLOSE_LOOP, 1),
+        WCN36XX_CFG_VAL(ENABLE_LPWR_IMG_TRANSITION, 0),
+        WCN36XX_CFG_VAL(MAX_ASSOC_LIMIT, 10),
+        WCN36XX_CFG_VAL(ENABLE_MCC_ADAPTIVE_SCHEDULER, 0),
+};
+
 static int put_cfg_tlv_u32(struct wcn36xx *wcn, size_t *len, u32 id, u32 value)
 {
         struct wcn36xx_hal_cfg *entry;
@@ -357,8 +412,10 @@ static int wcn36xx_smd_start_rsp(struct wcn36xx *wcn, void *buf, size_t len)
 
 int wcn36xx_smd_start(struct wcn36xx *wcn)
 {
-        struct wcn36xx_hal_mac_start_req_msg msg_body;
+        struct wcn36xx_hal_mac_start_req_msg msg_body, *body;
         int ret = 0;
+        int i;
+        size_t len;
 
         mutex_lock(&wcn->hal_mutex);
         INIT_HAL_MSG(msg_body, WCN36XX_HAL_START_REQ);
@@ -368,10 +425,22 @@ int wcn36xx_smd_start(struct wcn36xx *wcn)
 
         PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
 
+        body = (struct wcn36xx_hal_mac_start_req_msg *)wcn->hal_buf;
+        len = body->header.len;
+
+        for (i = 0; i < ARRAY_SIZE(wcn36xx_cfg_vals); i++) {
+                ret = put_cfg_tlv_u32(wcn, &len, wcn36xx_cfg_vals[i].cfg_id,
+                                      wcn36xx_cfg_vals[i].value);
+                if (ret)
+                        goto out;
+        }
+        body->header.len = len;
+        body->params.len = len - sizeof(*body);
+
         wcn36xx_dbg(WCN36XX_DBG_HAL, "hal start type %d\n",
                     msg_body.params.type);
 
-        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        ret = wcn36xx_smd_send_and_wait(wcn, body->header.len);
         if (ret) {
                 wcn36xx_err("Sending hal_start failed\n");
                 goto out;
diff --git a/drivers/net/wireless/ath/wcn36xx/txrx.c b/drivers/net/wireless/ath/wcn36xx/txrx.c
index 32bb26a0db2a..9bec8237231d 100644
--- a/drivers/net/wireless/ath/wcn36xx/txrx.c
+++ b/drivers/net/wireless/ath/wcn36xx/txrx.c
@@ -93,6 +93,7 @@ static void wcn36xx_set_tx_pdu(struct wcn36xx_tx_bd *bd,
                 bd->pdu.mpdu_header_off;
         bd->pdu.mpdu_len = len;
         bd->pdu.tid = tid;
+        bd->pdu.bd_ssn = WCN36XX_TXBD_SSN_FILL_DPU_QOS;
 }
 
 static inline struct wcn36xx_vif *get_vif_by_addr(struct wcn36xx *wcn,
@@ -110,15 +111,54 @@ static inline struct wcn36xx_vif *get_vif_by_addr(struct wcn36xx *wcn,
         wcn36xx_warn("vif %pM not found\n", addr);
         return NULL;
 }
+
+static void wcn36xx_tx_start_ampdu(struct wcn36xx *wcn,
+                                   struct wcn36xx_sta *sta_priv,
+                                   struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        struct ieee80211_sta *sta;
+        u8 *qc, tid;
+
+        if (!conf_is_ht(&wcn->hw->conf))
+                return;
+
+        sta = wcn36xx_priv_to_sta(sta_priv);
+
+        if (WARN_ON(!ieee80211_is_data_qos(hdr->frame_control)))
+                return;
+
+        if (skb_get_queue_mapping(skb) == IEEE80211_AC_VO)
+                return;
+
+        qc = ieee80211_get_qos_ctl(hdr);
+        tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
+
+        spin_lock(&sta_priv->ampdu_lock);
+        if (sta_priv->ampdu_state[tid] != WCN36XX_AMPDU_NONE)
+                goto out_unlock;
+
+        if (sta_priv->non_agg_frame_ct++ >= WCN36XX_AMPDU_START_THRESH) {
+                sta_priv->ampdu_state[tid] = WCN36XX_AMPDU_START;
+                sta_priv->non_agg_frame_ct = 0;
+                ieee80211_start_tx_ba_session(sta, tid, 0);
+        }
+out_unlock:
+        spin_unlock(&sta_priv->ampdu_lock);
+}
+
 static void wcn36xx_set_tx_data(struct wcn36xx_tx_bd *bd,
                                 struct wcn36xx *wcn,
                                 struct wcn36xx_vif **vif_priv,
                                 struct wcn36xx_sta *sta_priv,
-                                struct ieee80211_hdr *hdr,
+                                struct sk_buff *skb,
                                 bool bcast)
 {
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         struct ieee80211_vif *vif = NULL;
         struct wcn36xx_vif *__vif_priv = NULL;
+        bool is_data_qos;
+
         bd->bd_rate = WCN36XX_BD_RATE_DATA;
 
         /*
@@ -157,14 +197,26 @@ static void wcn36xx_set_tx_data(struct wcn36xx_tx_bd *bd,
                 bd->ack_policy = 1;
         }
         *vif_priv = __vif_priv;
+
+        is_data_qos = ieee80211_is_data_qos(hdr->frame_control);
+
+        wcn36xx_set_tx_pdu(bd,
+                           is_data_qos ?
+                           sizeof(struct ieee80211_qos_hdr) :
+                           sizeof(struct ieee80211_hdr_3addr),
+                           skb->len, sta_priv ? sta_priv->tid : 0);
+
+        if (sta_priv && is_data_qos)
+                wcn36xx_tx_start_ampdu(wcn, sta_priv, skb);
 }
 
 static void wcn36xx_set_tx_mgmt(struct wcn36xx_tx_bd *bd,
                                 struct wcn36xx *wcn,
                                 struct wcn36xx_vif **vif_priv,
-                                struct ieee80211_hdr *hdr,
+                                struct sk_buff *skb,
                                 bool bcast)
 {
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         struct wcn36xx_vif *__vif_priv =
                 get_vif_by_addr(wcn, hdr->addr2);
         bd->sta_index = __vif_priv->self_sta_index;
@@ -198,6 +250,12 @@ static void wcn36xx_set_tx_mgmt(struct wcn36xx_tx_bd *bd,
         } else
                 bd->queue_id = WCN36XX_TX_U_WQ_ID;
         *vif_priv = __vif_priv;
+
+        wcn36xx_set_tx_pdu(bd,
+                           ieee80211_is_data_qos(hdr->frame_control) ?
+                           sizeof(struct ieee80211_qos_hdr) :
+                           sizeof(struct ieee80211_hdr_3addr),
+                           skb->len, WCN36XX_TID);
 }
 
 int wcn36xx_start_tx(struct wcn36xx *wcn,
@@ -237,7 +295,7 @@ int wcn36xx_start_tx(struct wcn36xx *wcn,
 
         bd->dpu_rf = WCN36XX_BMU_WQ_TX;
 
-        bd->tx_comp = info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS;
+        bd->tx_comp = !!(info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS);
         if (bd->tx_comp) {
                 wcn36xx_dbg(WCN36XX_DBG_DXE, "TX_ACK status requested\n");
                 spin_lock_irqsave(&wcn->dxe_lock, flags);
@@ -259,22 +317,11 @@ int wcn36xx_start_tx(struct wcn36xx *wcn,
         }
 
         /* Data frames served first*/
-        if (is_low) {
-                wcn36xx_set_tx_data(bd, wcn, &vif_priv, sta_priv, hdr, bcast);
-                wcn36xx_set_tx_pdu(bd,
-                           ieee80211_is_data_qos(hdr->frame_control) ?
-                           sizeof(struct ieee80211_qos_hdr) :
-                           sizeof(struct ieee80211_hdr_3addr),
-                           skb->len, sta_priv ? sta_priv->tid : 0);
-        } else {
+        if (is_low)
+                wcn36xx_set_tx_data(bd, wcn, &vif_priv, sta_priv, skb, bcast);
+        else
                 /* MGMT and CTRL frames are handeld here*/
-                wcn36xx_set_tx_mgmt(bd, wcn, &vif_priv, hdr, bcast);
-                wcn36xx_set_tx_pdu(bd,
-                           ieee80211_is_data_qos(hdr->frame_control) ?
-                           sizeof(struct ieee80211_qos_hdr) :
-                           sizeof(struct ieee80211_hdr_3addr),
-                           skb->len, WCN36XX_TID);
-        }
+                wcn36xx_set_tx_mgmt(bd, wcn, &vif_priv, skb, bcast);
 
         buff_to_be((u32 *)bd, sizeof(*bd)/sizeof(u32));
         bd->tx_bd_sign = 0xbdbdbdbd;
diff --git a/drivers/net/wireless/ath/wcn36xx/txrx.h b/drivers/net/wireless/ath/wcn36xx/txrx.h
index bbfbcf808c77..032216e82b2b 100644
--- a/drivers/net/wireless/ath/wcn36xx/txrx.h
+++ b/drivers/net/wireless/ath/wcn36xx/txrx.h
@@ -32,6 +32,12 @@
 #define WCN36XX_BD_RATE_MGMT 2
 #define WCN36XX_BD_RATE_CTRL 3
 
+enum wcn36xx_txbd_ssn_type {
+        WCN36XX_TXBD_SSN_FILL_HOST = 0,
+        WCN36XX_TXBD_SSN_FILL_DPU_NON_QOS = 1,
+        WCN36XX_TXBD_SSN_FILL_DPU_QOS = 2,
+};
+
 struct wcn36xx_pdu {
         u32     dpu_fb:8;
         u32     adu_fb:8;
@@ -50,7 +56,8 @@ struct wcn36xx_pdu {
         /* 0x0c*/
         u32     reserved4:8;
         u32     tid:4;
-        u32     reserved3:4;
+        u32     bd_ssn:2;
+        u32     reserved3:2;
         u32     mpdu_len:16;
 };
 
diff --git a/drivers/net/wireless/ath/wcn36xx/wcn36xx.h b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
index f0fb81dfd17b..7b41e833e18c 100644
--- a/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
+++ b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
@@ -32,6 +32,9 @@
 #define WLAN_NV_FILE               "wlan/prima/WCNSS_qcom_wlan_nv.bin"
 #define WCN36XX_AGGR_BUFFER_SIZE 64
 
+/* How many frames until we start a-mpdu TX session */
+#define WCN36XX_AMPDU_START_THRESH      20
+
 extern unsigned int wcn36xx_dbg_mask;
 
 enum wcn36xx_debug_mask {
@@ -74,6 +77,13 @@ enum wcn36xx_debug_mask {
                                buf, len, false);                \
 } while (0)
 
+enum wcn36xx_ampdu_state {
+        WCN36XX_AMPDU_NONE,
+        WCN36XX_AMPDU_INIT,
+        WCN36XX_AMPDU_START,
+        WCN36XX_AMPDU_OPERATIONAL,
+};
+
 #define WCN36XX_HW_CHANNEL(__wcn) (__wcn->hw->conf.chandef.chan->hw_value)
 #define WCN36XX_BAND(__wcn) (__wcn->hw->conf.chandef.chan->band)
 #define WCN36XX_CENTER_FREQ(__wcn) (__wcn->hw->conf.chandef.chan->center_freq)
@@ -165,6 +175,10 @@ struct wcn36xx_sta {
         bool is_data_encrypted;
         /* Rates */
         struct wcn36xx_hal_supported_rates supported_rates;
+
+        spinlock_t ampdu_lock;          /* protects next two fields */
+        enum wcn36xx_ampdu_state ampdu_state[16];
+        int non_agg_frame_ct;
 };
 struct wcn36xx_dxe_ch;
 struct wcn36xx {
@@ -243,4 +257,10 @@ static inline bool wcn36xx_is_fw_version(struct wcn36xx *wcn,
 }
 void wcn36xx_set_default_rates(struct wcn36xx_hal_supported_rates *rates);
 
+static inline
+struct ieee80211_sta *wcn36xx_priv_to_sta(struct wcn36xx_sta *sta_priv)
+{
+        return container_of((void *)sta_priv, struct ieee80211_sta, drv_priv);
+}
+
 #endif  /* _WCN36XX_H_ */
diff --git a/drivers/net/wireless/ath/wil6210/Kconfig b/drivers/net/wireless/ath/wil6210/Kconfig
index 481680a3aa55..ce8c0381825e 100644
--- a/drivers/net/wireless/ath/wil6210/Kconfig
+++ b/drivers/net/wireless/ath/wil6210/Kconfig
@@ -39,12 +39,3 @@ config WIL6210_TRACING
           option if you are interested in debugging the driver.
 
           If unsure, say Y to make it easier to debug problems.
-
-config WIL6210_PLATFORM_MSM
-        bool "wil6210 MSM platform specific support"
-        depends on WIL6210
-        depends on ARCH_MSM
-        default y
-        ---help---
-          Say Y here to enable wil6210 driver support for MSM
-          platform specific features
diff --git a/drivers/net/wireless/ath/wil6210/Makefile b/drivers/net/wireless/ath/wil6210/Makefile
index 8ad4b5f97e04..caa717bf52f3 100644
--- a/drivers/net/wireless/ath/wil6210/Makefile
+++ b/drivers/net/wireless/ath/wil6210/Makefile
@@ -14,7 +14,6 @@ wil6210-y += ioctl.o
 wil6210-y += fw.o
 wil6210-$(CONFIG_WIL6210_TRACING) += trace.o
 wil6210-y += wil_platform.o
-wil6210-$(CONFIG_WIL6210_PLATFORM_MSM) += wil_platform_msm.o
 wil6210-y += ethtool.o
 
 # for tracing framework to find trace.h
diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c
index 38332a6dfb3a..2d5ea21be47e 100644
--- a/drivers/net/wireless/ath/wil6210/cfg80211.c
+++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 Qualcomm Atheros, Inc.
+ * Copyright (c) 2012-2015 Qualcomm Atheros, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -142,14 +142,14 @@ int wil_cid_fill_sinfo(struct wil6210_priv *wil, int cid,
 
         sinfo->generation = wil->sinfo_gen;
 
-        sinfo->filled = STATION_INFO_RX_BYTES |
-                        STATION_INFO_TX_BYTES |
-                        STATION_INFO_RX_PACKETS |
-                        STATION_INFO_TX_PACKETS |
-                        STATION_INFO_RX_BITRATE |
-                        STATION_INFO_TX_BITRATE |
-                        STATION_INFO_RX_DROP_MISC |
-                        STATION_INFO_TX_FAILED;
+        sinfo->filled = BIT(NL80211_STA_INFO_RX_BYTES) |
+                        BIT(NL80211_STA_INFO_TX_BYTES) |
+                        BIT(NL80211_STA_INFO_RX_PACKETS) |
+                        BIT(NL80211_STA_INFO_TX_PACKETS) |
+                        BIT(NL80211_STA_INFO_RX_BITRATE) |
+                        BIT(NL80211_STA_INFO_TX_BITRATE) |
+                        BIT(NL80211_STA_INFO_RX_DROP_MISC) |
+                        BIT(NL80211_STA_INFO_TX_FAILED);
 
         sinfo->txrate.flags = RATE_INFO_FLAGS_MCS | RATE_INFO_FLAGS_60G;
         sinfo->txrate.mcs = le16_to_cpu(reply.evt.bf_mcs);
@@ -162,8 +162,8 @@ int wil_cid_fill_sinfo(struct wil6210_priv *wil, int cid,
         sinfo->tx_packets = stats->tx_packets;
         sinfo->tx_failed = stats->tx_errors;
 
-        if (test_bit(wil_status_fwconnected, &wil->status)) {
-                sinfo->filled |= STATION_INFO_SIGNAL;
+        if (test_bit(wil_status_fwconnected, wil->status)) {
+                sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
                 sinfo->signal = reply.evt.sqi;
         }
 
@@ -282,7 +282,7 @@ static int wil_cfg80211_scan(struct wiphy *wiphy,
         }
 
         /* FW don't support scan after connection attempt */
-        if (test_bit(wil_status_dontscan, &wil->status)) {
+        if (test_bit(wil_status_dontscan, wil->status)) {
                 wil_err(wil, "Can't scan now\n");
                 return -EBUSY;
         }
@@ -334,6 +334,30 @@ out:
         return rc;
 }
 
+static void wil_print_crypto(struct wil6210_priv *wil,
+                             struct cfg80211_crypto_settings *c)
+{
+        int i, n;
+
+        wil_dbg_misc(wil, "WPA versions: 0x%08x cipher group 0x%08x\n",
+                     c->wpa_versions, c->cipher_group);
+        wil_dbg_misc(wil, "Pairwise ciphers [%d] {\n", c->n_ciphers_pairwise);
+        n = min_t(int, c->n_ciphers_pairwise, ARRAY_SIZE(c->ciphers_pairwise));
+        for (i = 0; i < n; i++)
+                wil_dbg_misc(wil, "  [%d] = 0x%08x\n", i,
+                             c->ciphers_pairwise[i]);
+        wil_dbg_misc(wil, "}\n");
+        wil_dbg_misc(wil, "AKM suites [%d] {\n", c->n_akm_suites);
+        n = min_t(int, c->n_akm_suites, ARRAY_SIZE(c->akm_suites));
+        for (i = 0; i < n; i++)
+                wil_dbg_misc(wil, "  [%d] = 0x%08x\n", i,
+                             c->akm_suites[i]);
+        wil_dbg_misc(wil, "}\n");
+        wil_dbg_misc(wil, "Control port : %d, eth_type 0x%04x no_encrypt %d\n",
+                     c->control_port, be16_to_cpu(c->control_port_ethertype),
+                     c->control_port_no_encrypt);
+}
+
 static void wil_print_connect_params(struct wil6210_priv *wil,
                                      struct cfg80211_connect_params *sme)
 {
@@ -348,6 +372,7 @@ static void wil_print_connect_params(struct wil6210_priv *wil,
                 print_hex_dump(KERN_INFO, "  SSID: ", DUMP_PREFIX_OFFSET,
                                16, 1, sme->ssid, sme->ssid_len, true);
         wil_info(wil, "  Privacy: %s\n", sme->privacy ? "secure" : "open");
+        wil_print_crypto(wil, &sme->crypto);
 }
 
 static int wil_cfg80211_connect(struct wiphy *wiphy,
@@ -362,8 +387,8 @@ static int wil_cfg80211_connect(struct wiphy *wiphy,
         int ch;
         int rc = 0;
 
-        if (test_bit(wil_status_fwconnecting, &wil->status) ||
-            test_bit(wil_status_fwconnected, &wil->status))
+        if (test_bit(wil_status_fwconnecting, wil->status) ||
+            test_bit(wil_status_fwconnected, wil->status))
                 return -EALREADY;
 
         wil_print_connect_params(wil, sme);
@@ -450,15 +475,16 @@ static int wil_cfg80211_connect(struct wiphy *wiphy,
         memcpy(conn.bssid, bss->bssid, ETH_ALEN);
         memcpy(conn.dst_mac, bss->bssid, ETH_ALEN);
 
-        set_bit(wil_status_fwconnecting, &wil->status);
+        set_bit(wil_status_fwconnecting, wil->status);
 
         rc = wmi_send(wil, WMI_CONNECT_CMDID, &conn, sizeof(conn));
         if (rc == 0) {
+                netif_carrier_on(ndev);
                 /* Connect can take lots of time */
                 mod_timer(&wil->connect_timer,
                           jiffies + msecs_to_jiffies(2000));
         } else {
-                clear_bit(wil_status_fwconnecting, &wil->status);
+                clear_bit(wil_status_fwconnecting, wil->status);
         }
 
  out:
@@ -618,18 +644,6 @@ static void wil_print_bcon_data(struct cfg80211_beacon_data *b)
                              b->assocresp_ies, b->assocresp_ies_len);
 }
 
-static void wil_print_crypto(struct wil6210_priv *wil,
-                             struct cfg80211_crypto_settings *c)
-{
-        wil_dbg_misc(wil, "WPA versions: 0x%08x cipher group 0x%08x\n",
-                     c->wpa_versions, c->cipher_group);
-        wil_dbg_misc(wil, "Pairwise ciphers [%d]\n", c->n_ciphers_pairwise);
-        wil_dbg_misc(wil, "AKM suites [%d]\n", c->n_akm_suites);
-        wil_dbg_misc(wil, "Control port : %d, eth_type 0x%04x no_encrypt %d\n",
-                     c->control_port, be16_to_cpu(c->control_port_ethertype),
-                     c->control_port_no_encrypt);
-}
-
 static int wil_fix_bcon(struct wil6210_priv *wil,
                         struct cfg80211_beacon_data *bcon)
 {
@@ -757,12 +771,12 @@ static int wil_cfg80211_start_ap(struct wiphy *wiphy,
 
         wil->secure_pcp = info->privacy;
 
+        netif_carrier_on(ndev);
+
         rc = wmi_pcp_start(wil, info->beacon_interval, wmi_nettype,
                            channel->hw_value);
         if (rc)
-                goto out;
-
-        netif_carrier_on(ndev);
+                netif_carrier_off(ndev);
 
 out:
         mutex_unlock(&wil->mutex);
@@ -772,23 +786,26 @@ out:
 static int wil_cfg80211_stop_ap(struct wiphy *wiphy,
                                 struct net_device *ndev)
 {
-        int rc, rc1;
         struct wil6210_priv *wil = wiphy_to_wil(wiphy);
 
         wil_dbg_misc(wil, "%s()\n", __func__);
 
+        netif_carrier_off(ndev);
         wil_set_recovery_state(wil, fw_recovery_idle);
 
         mutex_lock(&wil->mutex);
 
-        rc = wmi_pcp_stop(wil);
+        wmi_pcp_stop(wil);
 
         __wil_down(wil);
-        rc1 = __wil_up(wil);
+        __wil_up(wil);
 
         mutex_unlock(&wil->mutex);
 
-        return min(rc, rc1);
+        /* some functions above might fail (e.g. __wil_up). Nevertheless, we
+         * return success because AP has stopped
+         */
+        return 0;
 }
 
 static int wil_cfg80211_del_station(struct wiphy *wiphy,
@@ -804,6 +821,96 @@ static int wil_cfg80211_del_station(struct wiphy *wiphy,
         return 0;
 }
 
+/* probe_client handling */
+static void wil_probe_client_handle(struct wil6210_priv *wil,
+                                    struct wil_probe_client_req *req)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct wil_sta_info *sta = &wil->sta[req->cid];
+        /* assume STA is alive if it is still connected,
+         * else FW will disconnect it
+         */
+        bool alive = (sta->status == wil_sta_connected);
+
+        cfg80211_probe_status(ndev, sta->addr, req->cookie, alive, GFP_KERNEL);
+}
+
+static struct list_head *next_probe_client(struct wil6210_priv *wil)
+{
+        struct list_head *ret = NULL;
+
+        mutex_lock(&wil->probe_client_mutex);
+
+        if (!list_empty(&wil->probe_client_pending)) {
+                ret = wil->probe_client_pending.next;
+                list_del(ret);
+        }
+
+        mutex_unlock(&wil->probe_client_mutex);
+
+        return ret;
+}
+
+void wil_probe_client_worker(struct work_struct *work)
+{
+        struct wil6210_priv *wil = container_of(work, struct wil6210_priv,
+                                                probe_client_worker);
+        struct wil_probe_client_req *req;
+        struct list_head *lh;
+
+        while ((lh = next_probe_client(wil)) != NULL) {
+                req = list_entry(lh, struct wil_probe_client_req, list);
+
+                wil_probe_client_handle(wil, req);
+                kfree(req);
+        }
+}
+
+void wil_probe_client_flush(struct wil6210_priv *wil)
+{
+        struct wil_probe_client_req *req, *t;
+
+        wil_dbg_misc(wil, "%s()\n", __func__);
+
+        mutex_lock(&wil->probe_client_mutex);
+
+        list_for_each_entry_safe(req, t, &wil->probe_client_pending, list) {
+                list_del(&req->list);
+                kfree(req);
+        }
+
+        mutex_unlock(&wil->probe_client_mutex);
+}
+
+static int wil_cfg80211_probe_client(struct wiphy *wiphy,
+                                     struct net_device *dev,
+                                     const u8 *peer, u64 *cookie)
+{
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+        struct wil_probe_client_req *req;
+        int cid = wil_find_cid(wil, peer);
+
+        wil_dbg_misc(wil, "%s(%pM => CID %d)\n", __func__, peer, cid);
+
+        if (cid < 0)
+                return -ENOLINK;
+
+        req = kzalloc(sizeof(*req), GFP_KERNEL);
+        if (!req)
+                return -ENOMEM;
+
+        req->cid = cid;
+        req->cookie = cid;
+
+        mutex_lock(&wil->probe_client_mutex);
+        list_add_tail(&req->list, &wil->probe_client_pending);
+        mutex_unlock(&wil->probe_client_mutex);
+
+        *cookie = req->cookie;
+        queue_work(wil->wq_service, &wil->probe_client_worker);
+        return 0;
+}
+
 static struct cfg80211_ops wil_cfg80211_ops = {
         .scan = wil_cfg80211_scan,
         .connect = wil_cfg80211_connect,
@@ -823,6 +930,7 @@ static struct cfg80211_ops wil_cfg80211_ops = {
         .start_ap = wil_cfg80211_start_ap,
         .stop_ap = wil_cfg80211_stop_ap,
         .del_station = wil_cfg80211_del_station,
+        .probe_client = wil_cfg80211_probe_client,
 };
 
 static void wil_wiphy_init(struct wiphy *wiphy)
@@ -854,6 +962,7 @@ static void wil_wiphy_init(struct wiphy *wiphy)
         wiphy->cipher_suites = wil_cipher_suites;
         wiphy->n_cipher_suites = ARRAY_SIZE(wil_cipher_suites);
         wiphy->mgmt_stypes = wil_mgmt_stypes;
+        wiphy->features |= NL80211_FEATURE_SK_TX_STATUS;
 }
 
 struct wireless_dev *wil_cfg80211_init(struct device *dev)
diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
index 4e6e14501c2f..45c3558ec804 100644
--- a/drivers/net/wireless/ath/wil6210/debugfs.c
+++ b/drivers/net/wireless/ath/wil6210/debugfs.c
@@ -50,6 +50,7 @@ static void wil_print_vring(struct seq_file *s, struct wil6210_priv *wil,
                             char _s, char _h)
 {
         void __iomem *x = wmi_addr(wil, vring->hwtail);
+        u32 v;
 
         seq_printf(s, "VRING %s = {\n", name);
         seq_printf(s, "  pa     = %pad\n", &vring->pa);
@@ -58,10 +59,12 @@ static void wil_print_vring(struct seq_file *s, struct wil6210_priv *wil,
         seq_printf(s, "  swtail = %d\n", vring->swtail);
         seq_printf(s, "  swhead = %d\n", vring->swhead);
         seq_printf(s, "  hwtail = [0x%08x] -> ", vring->hwtail);
-        if (x)
-                seq_printf(s, "0x%08x\n", ioread32(x));
-        else
+        if (x) {
+                v = ioread32(x);
+                seq_printf(s, "0x%08x = %d\n", v, v);
+        } else {
                 seq_puts(s, "???\n");
+        }
 
         if (vring->va && (vring->size < 1025)) {
                 uint i;
@@ -101,8 +104,8 @@ static int wil_vring_debugfs_show(struct seq_file *s, void *data)
                         char name[10];
                         /* performance monitoring */
                         cycles_t now = get_cycles();
-                        cycles_t idle = txdata->idle * 100;
-                        cycles_t total = now - txdata->begin;
+                        uint64_t idle = txdata->idle * 100;
+                        uint64_t total = now - txdata->begin;
 
                         do_div(idle, total);
                         txdata->begin = now;
@@ -110,9 +113,12 @@ static int wil_vring_debugfs_show(struct seq_file *s, void *data)
 
                         snprintf(name, sizeof(name), "tx_%2d", i);
 
-                        seq_printf(s, "\n%pM CID %d TID %d [%3d|%3d] idle %3d%%\n",
-                                   wil->sta[cid].addr, cid, tid, used, avail,
-                                   (int)idle);
+                        seq_printf(s,
+                                   "\n%pM CID %d TID %d BACK([%d] %d TU A%s) [%3d|%3d] idle %3d%%\n",
+                                   wil->sta[cid].addr, cid, tid,
+                                   txdata->agg_wsize, txdata->agg_timeout,
+                                   txdata->agg_amsdu ? "+" : "-",
+                                   used, avail, (int)idle);
 
                         wil_print_vring(s, wil, name, vring, '_', 'H');
                 }
@@ -384,24 +390,67 @@ static int wil6210_debugfs_create_pseudo_ISR(struct wil6210_priv *wil,
         return 0;
 }
 
-static const struct dbg_off itr_cnt_off[] = {
+static const struct dbg_off lgc_itr_cnt_off[] = {
         {"TRSH", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_CNT_TRSH), doff_io32},
         {"DATA", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_CNT_DATA), doff_io32},
         {"CTL",  S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_CNT_CRL), doff_io32},
         {},
 };
 
+static const struct dbg_off tx_itr_cnt_off[] = {
+        {"TRSH", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_TX_CNT_TRSH),
+         doff_io32},
+        {"DATA", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_TX_CNT_DATA),
+         doff_io32},
+        {"CTL",  S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_TX_CNT_CTL),
+         doff_io32},
+        {"IDL_TRSH", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_TX_IDL_CNT_TRSH),
+         doff_io32},
+        {"IDL_DATA", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_TX_IDL_CNT_DATA),
+         doff_io32},
+        {"IDL_CTL",  S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_TX_IDL_CNT_CTL),
+         doff_io32},
+        {},
+};
+
+static const struct dbg_off rx_itr_cnt_off[] = {
+        {"TRSH", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_RX_CNT_TRSH),
+         doff_io32},
+        {"DATA", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_RX_CNT_DATA),
+         doff_io32},
+        {"CTL",  S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_RX_CNT_CTL),
+         doff_io32},
+        {"IDL_TRSH", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_RX_IDL_CNT_TRSH),
+         doff_io32},
+        {"IDL_DATA", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_RX_IDL_CNT_DATA),
+         doff_io32},
+        {"IDL_CTL",  S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_RX_IDL_CNT_CTL),
+         doff_io32},
+        {},
+};
+
 static int wil6210_debugfs_create_ITR_CNT(struct wil6210_priv *wil,
                                           struct dentry *parent)
 {
-        struct dentry *d = debugfs_create_dir("ITR_CNT", parent);
+        struct dentry *d, *dtx, *drx;
 
+        d = debugfs_create_dir("ITR_CNT", parent);
         if (IS_ERR_OR_NULL(d))
                 return -ENODEV;
 
+        dtx = debugfs_create_dir("TX", d);
+        drx = debugfs_create_dir("RX", d);
+        if (IS_ERR_OR_NULL(dtx) || IS_ERR_OR_NULL(drx))
+                return -ENODEV;
+
         wil6210_debugfs_init_offset(wil, d, (void * __force)wil->csr,
-                                    itr_cnt_off);
+                                    lgc_itr_cnt_off);
+
+        wil6210_debugfs_init_offset(wil, dtx, (void * __force)wil->csr,
+                                    tx_itr_cnt_off);
 
+        wil6210_debugfs_init_offset(wil, drx, (void * __force)wil->csr,
+                                    rx_itr_cnt_off);
         return 0;
 }
 
@@ -558,6 +607,87 @@ static const struct file_operations fops_rxon = {
         .open  = simple_open,
 };
 
+/* block ack control, write:
+ * - "add <ringid> <agg_size> <timeout>" to trigger ADDBA
+ * - "del_tx <ringid> <reason>" to trigger DELBA for Tx side
+ * - "del_rx <CID> <TID> <reason>" to trigger DELBA for Rx side
+ */
+static ssize_t wil_write_back(struct file *file, const char __user *buf,
+                              size_t len, loff_t *ppos)
+{
+        struct wil6210_priv *wil = file->private_data;
+        int rc;
+        char *kbuf = kmalloc(len + 1, GFP_KERNEL);
+        char cmd[8];
+        int p1, p2, p3;
+
+        if (!kbuf)
+                return -ENOMEM;
+
+        rc = simple_write_to_buffer(kbuf, len, ppos, buf, len);
+        if (rc != len) {
+                kfree(kbuf);
+                return rc >= 0 ? -EIO : rc;
+        }
+
+        kbuf[len] = '\0';
+        rc = sscanf(kbuf, "%8s %d %d %d", cmd, &p1, &p2, &p3);
+        kfree(kbuf);
+
+        if (rc < 0)
+                return rc;
+        if (rc < 2)
+                return -EINVAL;
+
+        if (0 == strcmp(cmd, "add")) {
+                if (rc < 3) {
+                        wil_err(wil, "BACK: add require at least 2 params\n");
+                        return -EINVAL;
+                }
+                if (rc < 4)
+                        p3 = 0;
+                wmi_addba(wil, p1, p2, p3);
+        } else if (0 == strcmp(cmd, "del_tx")) {
+                if (rc < 3)
+                        p2 = WLAN_REASON_QSTA_LEAVE_QBSS;
+                wmi_delba_tx(wil, p1, p2);
+        } else if (0 == strcmp(cmd, "del_rx")) {
+                if (rc < 3) {
+                        wil_err(wil,
+                                "BACK: del_rx require at least 2 params\n");
+                        return -EINVAL;
+                }
+                if (rc < 4)
+                        p3 = WLAN_REASON_QSTA_LEAVE_QBSS;
+                wmi_delba_rx(wil, mk_cidxtid(p1, p2), p3);
+        } else {
+                wil_err(wil, "BACK: Unrecognized command \"%s\"\n", cmd);
+                return -EINVAL;
+        }
+
+        return len;
+}
+
+static ssize_t wil_read_back(struct file *file, char __user *user_buf,
+                             size_t count, loff_t *ppos)
+{
+        static const char text[] = "block ack control, write:\n"
+        " - \"add <ringid> <agg_size> <timeout>\" to trigger ADDBA\n"
+        "If missing, <timeout> defaults to 0\n"
+        " - \"del_tx <ringid> <reason>\" to trigger DELBA for Tx side\n"
+        " - \"del_rx <CID> <TID> <reason>\" to trigger DELBA for Rx side\n"
+        "If missing, <reason> set to \"STA_LEAVING\" (36)\n";
+
+        return simple_read_from_buffer(user_buf, count, ppos, text,
+                                       sizeof(text));
+}
+
+static const struct file_operations fops_back = {
+        .read = wil_read_back,
+        .write = wil_write_back,
+        .open  = simple_open,
+};
+
 /*---tx_mgmt---*/
 /* Write mgmt frame to this file to send it */
 static ssize_t wil_write_file_txmgmt(struct file *file, const char __user *buf,
@@ -1116,7 +1246,8 @@ static void wil_print_rxtid(struct seq_file *s, struct wil_tid_ampdu_rx *r)
         int i;
         u16 index = ((r->head_seq_num - r->ssn) & 0xfff) % r->buf_size;
 
-        seq_printf(s, "0x%03x [", r->head_seq_num);
+        seq_printf(s, "([%2d] %3d TU) 0x%03x [", r->buf_size, r->timeout,
+                   r->head_seq_num);
         for (i = 0; i < r->buf_size; i++) {
                 if (i == index)
                         seq_printf(s, "%c", r->reorder_buf[i] ? 'O' : '|');
@@ -1127,10 +1258,10 @@ static void wil_print_rxtid(struct seq_file *s, struct wil_tid_ampdu_rx *r)
 }
 
 static int wil_sta_debugfs_show(struct seq_file *s, void *data)
+__acquires(&p->tid_rx_lock) __releases(&p->tid_rx_lock)
 {
         struct wil6210_priv *wil = s->private;
         int i, tid;
-        unsigned long flags;
 
         for (i = 0; i < ARRAY_SIZE(wil->sta); i++) {
                 struct wil_sta_info *p = &wil->sta[i];
@@ -1151,7 +1282,7 @@ static int wil_sta_debugfs_show(struct seq_file *s, void *data)
                            (p->data_port_open ? " data_port_open" : ""));
 
                 if (p->status == wil_sta_connected) {
-                        spin_lock_irqsave(&p->tid_rx_lock, flags);
+                        spin_lock_bh(&p->tid_rx_lock);
                         for (tid = 0; tid < WIL_STA_TID_NUM; tid++) {
                                 struct wil_tid_ampdu_rx *r = p->tid_rx[tid];
 
@@ -1160,7 +1291,7 @@ static int wil_sta_debugfs_show(struct seq_file *s, void *data)
                                         wil_print_rxtid(s, r);
                                 }
                         }
-                        spin_unlock_irqrestore(&p->tid_rx_lock, flags);
+                        spin_unlock_bh(&p->tid_rx_lock);
                 }
         }
 
@@ -1217,6 +1348,7 @@ static const struct {
         {"rxon",                  S_IWUSR,      &fops_rxon},
         {"tx_mgmt",               S_IWUSR,      &fops_txmgmt},
         {"wmi_send",              S_IWUSR,      &fops_wmi},
+        {"back",        S_IRUGO | S_IWUSR,      &fops_back},
         {"temp",        S_IRUGO,                &fops_temp},
         {"freq",        S_IRUGO,                &fops_freq},
         {"link",        S_IRUGO,                &fops_link},
@@ -1261,7 +1393,7 @@ static void wil6210_debugfs_init_isr(struct wil6210_priv *wil,
 /* fields in struct wil6210_priv */
 static const struct dbg_off dbg_wil_off[] = {
         WIL_FIELD(secure_pcp,   S_IRUGO | S_IWUSR,      doff_u32),
-        WIL_FIELD(status,       S_IRUGO | S_IWUSR,      doff_ulong),
+        WIL_FIELD(status[0],    S_IRUGO | S_IWUSR,      doff_ulong),
         WIL_FIELD(fw_version,   S_IRUGO,                doff_u32),
         WIL_FIELD(hw_version,   S_IRUGO,                doff_x32),
         WIL_FIELD(recovery_count, S_IRUGO,              doff_u32),
diff --git a/drivers/net/wireless/ath/wil6210/ethtool.c b/drivers/net/wireless/ath/wil6210/ethtool.c
index d686638972be..4c44a82c34d7 100644
--- a/drivers/net/wireless/ath/wil6210/ethtool.c
+++ b/drivers/net/wireless/ath/wil6210/ethtool.c
@@ -45,16 +45,35 @@ static int wil_ethtoolops_get_coalesce(struct net_device *ndev,
                                        struct ethtool_coalesce *cp)
 {
         struct wil6210_priv *wil = ndev_to_wil(ndev);
-        u32 itr_en, itr_val = 0;
+        u32 tx_itr_en, tx_itr_val = 0;
+        u32 rx_itr_en, rx_itr_val = 0;
 
         wil_dbg_misc(wil, "%s()\n", __func__);
 
-        itr_en = ioread32(wil->csr + HOSTADDR(RGF_DMA_ITR_CNT_CRL));
-        if (itr_en & BIT_DMA_ITR_CNT_CRL_EN)
-                itr_val = ioread32(wil->csr + HOSTADDR(RGF_DMA_ITR_CNT_TRSH));
-
-        cp->rx_coalesce_usecs = itr_val;
+        if (test_bit(hw_capability_advanced_itr_moderation,
+                     wil->hw_capabilities)) {
+                tx_itr_en = ioread32(wil->csr +
+                                     HOSTADDR(RGF_DMA_ITR_TX_CNT_CTL));
+                if (tx_itr_en & BIT_DMA_ITR_TX_CNT_CTL_EN)
+                        tx_itr_val =
+                                ioread32(wil->csr +
+                                         HOSTADDR(RGF_DMA_ITR_TX_CNT_TRSH));
+
+                rx_itr_en = ioread32(wil->csr +
+                                     HOSTADDR(RGF_DMA_ITR_RX_CNT_CTL));
+                if (rx_itr_en & BIT_DMA_ITR_RX_CNT_CTL_EN)
+                        rx_itr_val =
+                                ioread32(wil->csr +
+                                         HOSTADDR(RGF_DMA_ITR_RX_CNT_TRSH));
+        } else {
+                rx_itr_en = ioread32(wil->csr + HOSTADDR(RGF_DMA_ITR_CNT_CRL));
+                if (rx_itr_en & BIT_DMA_ITR_CNT_CRL_EN)
+                        rx_itr_val = ioread32(wil->csr +
+                                              HOSTADDR(RGF_DMA_ITR_CNT_TRSH));
+        }
 
+        cp->tx_coalesce_usecs = tx_itr_val;
+        cp->rx_coalesce_usecs = rx_itr_val;
         return 0;
 }
 
@@ -63,22 +82,25 @@ static int wil_ethtoolops_set_coalesce(struct net_device *ndev,
 {
         struct wil6210_priv *wil = ndev_to_wil(ndev);
 
-        wil_dbg_misc(wil, "%s(%d usec)\n", __func__, cp->rx_coalesce_usecs);
+        wil_dbg_misc(wil, "%s(rx %d usec, tx %d usec)\n", __func__,
+                     cp->rx_coalesce_usecs, cp->tx_coalesce_usecs);
 
         if (wil->wdev->iftype == NL80211_IFTYPE_MONITOR) {
                 wil_dbg_misc(wil, "No IRQ coalescing in monitor mode\n");
                 return -EINVAL;
         }
 
-        /* only @rx_coalesce_usecs supported, ignore
-         * other parameters
+        /* only @rx_coalesce_usecs and @tx_coalesce_usecs supported,
+         * ignore other parameters
          */
 
-        if (cp->rx_coalesce_usecs > WIL6210_ITR_TRSH_MAX)
+        if (cp->rx_coalesce_usecs > WIL6210_ITR_TRSH_MAX ||
+            cp->tx_coalesce_usecs > WIL6210_ITR_TRSH_MAX)
                 goto out_bad;
 
-        wil->itr_trsh = cp->rx_coalesce_usecs;
-        wil_set_itr_trsh(wil);
+        wil->tx_max_burst_duration = cp->tx_coalesce_usecs;
+        wil->rx_max_burst_duration = cp->rx_coalesce_usecs;
+        wil_configure_interrupt_moderation(wil);
 
         return 0;
 
diff --git a/drivers/net/wireless/ath/wil6210/interrupt.c b/drivers/net/wireless/ath/wil6210/interrupt.c
index 4bcbd6297b3e..a6f923086f31 100644
--- a/drivers/net/wireless/ath/wil6210/interrupt.c
+++ b/drivers/net/wireless/ath/wil6210/interrupt.c
@@ -102,7 +102,7 @@ static void wil6210_mask_irq_pseudo(struct wil6210_priv *wil)
         iowrite32(WIL6210_IRQ_DISABLE, wil->csr +
                   HOSTADDR(RGF_DMA_PSEUDO_CAUSE_MASK_SW));
 
-        clear_bit(wil_status_irqen, &wil->status);
+        clear_bit(wil_status_irqen, wil->status);
 }
 
 void wil6210_unmask_irq_tx(struct wil6210_priv *wil)
@@ -130,7 +130,7 @@ static void wil6210_unmask_irq_pseudo(struct wil6210_priv *wil)
 {
         wil_dbg_irq(wil, "%s()\n", __func__);
 
-        set_bit(wil_status_irqen, &wil->status);
+        set_bit(wil_status_irqen, wil->status);
 
         iowrite32(WIL6210_IRQ_PSEUDO_MASK, wil->csr +
                   HOSTADDR(RGF_DMA_PSEUDO_CAUSE_MASK_SW));
@@ -157,15 +157,91 @@ void wil_unmask_irq(struct wil6210_priv *wil)
         iowrite32(WIL_ICR_ICC_VALUE, wil->csr + HOSTADDR(RGF_DMA_EP_MISC_ICR) +
                   offsetof(struct RGF_ICR, ICC));
 
-        /* interrupt moderation parameters */
-        wil_set_itr_trsh(wil);
-
         wil6210_unmask_irq_pseudo(wil);
         wil6210_unmask_irq_tx(wil);
         wil6210_unmask_irq_rx(wil);
         wil6210_unmask_irq_misc(wil);
 }
 
+/* target write operation */
+#define W(a, v) do { iowrite32(v, wil->csr + HOSTADDR(a)); wmb(); } while (0)
+
+static
+void wil_configure_interrupt_moderation_new(struct wil6210_priv *wil)
+{
+        /* Disable and clear tx counter before (re)configuration */
+        W(RGF_DMA_ITR_TX_CNT_CTL, BIT_DMA_ITR_TX_CNT_CTL_CLR);
+        W(RGF_DMA_ITR_TX_CNT_TRSH, wil->tx_max_burst_duration);
+        wil_info(wil, "set ITR_TX_CNT_TRSH = %d usec\n",
+                 wil->tx_max_burst_duration);
+        /* Configure TX max burst duration timer to use usec units */
+        W(RGF_DMA_ITR_TX_CNT_CTL,
+          BIT_DMA_ITR_TX_CNT_CTL_EN | BIT_DMA_ITR_TX_CNT_CTL_EXT_TIC_SEL);
+
+        /* Disable and clear tx idle counter before (re)configuration */
+        W(RGF_DMA_ITR_TX_IDL_CNT_CTL, BIT_DMA_ITR_TX_IDL_CNT_CTL_CLR);
+        W(RGF_DMA_ITR_TX_IDL_CNT_TRSH, wil->tx_interframe_timeout);
+        wil_info(wil, "set ITR_TX_IDL_CNT_TRSH = %d usec\n",
+                 wil->tx_interframe_timeout);
+        /* Configure TX max burst duration timer to use usec units */
+        W(RGF_DMA_ITR_TX_IDL_CNT_CTL, BIT_DMA_ITR_TX_IDL_CNT_CTL_EN |
+                                      BIT_DMA_ITR_TX_IDL_CNT_CTL_EXT_TIC_SEL);
+
+        /* Disable and clear rx counter before (re)configuration */
+        W(RGF_DMA_ITR_RX_CNT_CTL, BIT_DMA_ITR_RX_CNT_CTL_CLR);
+        W(RGF_DMA_ITR_RX_CNT_TRSH, wil->rx_max_burst_duration);
+        wil_info(wil, "set ITR_RX_CNT_TRSH = %d usec\n",
+                 wil->rx_max_burst_duration);
+        /* Configure TX max burst duration timer to use usec units */
+        W(RGF_DMA_ITR_RX_CNT_CTL,
+          BIT_DMA_ITR_RX_CNT_CTL_EN | BIT_DMA_ITR_RX_CNT_CTL_EXT_TIC_SEL);
+
+        /* Disable and clear rx idle counter before (re)configuration */
+        W(RGF_DMA_ITR_RX_IDL_CNT_CTL, BIT_DMA_ITR_RX_IDL_CNT_CTL_CLR);
+        W(RGF_DMA_ITR_RX_IDL_CNT_TRSH, wil->rx_interframe_timeout);
+        wil_info(wil, "set ITR_RX_IDL_CNT_TRSH = %d usec\n",
+                 wil->rx_interframe_timeout);
+        /* Configure TX max burst duration timer to use usec units */
+        W(RGF_DMA_ITR_RX_IDL_CNT_CTL, BIT_DMA_ITR_RX_IDL_CNT_CTL_EN |
+                                      BIT_DMA_ITR_RX_IDL_CNT_CTL_EXT_TIC_SEL);
+}
+
+static
+void wil_configure_interrupt_moderation_lgc(struct wil6210_priv *wil)
+{
+        /* disable, use usec resolution */
+        W(RGF_DMA_ITR_CNT_CRL, BIT_DMA_ITR_CNT_CRL_CLR);
+
+        wil_info(wil, "set ITR_TRSH = %d usec\n", wil->rx_max_burst_duration);
+        W(RGF_DMA_ITR_CNT_TRSH, wil->rx_max_burst_duration);
+        /* start it */
+        W(RGF_DMA_ITR_CNT_CRL,
+          BIT_DMA_ITR_CNT_CRL_EN | BIT_DMA_ITR_CNT_CRL_EXT_TICK);
+}
+
+#undef W
+
+void wil_configure_interrupt_moderation(struct wil6210_priv *wil)
+{
+        wil_dbg_irq(wil, "%s()\n", __func__);
+
+        /* disable interrupt moderation for monitor
+         * to get better timestamp precision
+         */
+        if (wil->wdev->iftype == NL80211_IFTYPE_MONITOR)
+                return;
+
+        if (test_bit(hw_capability_advanced_itr_moderation,
+                     wil->hw_capabilities))
+                wil_configure_interrupt_moderation_new(wil);
+        else {
+                /* Advanced interrupt moderation is not available before
+                 * Sparrow v2. Will use legacy interrupt moderation
+                 */
+                wil_configure_interrupt_moderation_lgc(wil);
+        }
+}
+
 static irqreturn_t wil6210_irq_rx(int irq, void *cookie)
 {
         struct wil6210_priv *wil = cookie;
@@ -194,18 +270,19 @@ static irqreturn_t wil6210_irq_rx(int irq, void *cookie)
                 wil_dbg_irq(wil, "RX done\n");
 
                 if (isr & BIT_DMA_EP_RX_ICR_RX_HTRSH)
-                        wil_err_ratelimited(wil, "Received \"Rx buffer is in risk "
-                                "of overflow\" interrupt\n");
+                        wil_err_ratelimited(wil,
+                                            "Received \"Rx buffer is in risk of overflow\" interrupt\n");
 
-                isr &= ~(BIT_DMA_EP_RX_ICR_RX_DONE | BIT_DMA_EP_RX_ICR_RX_HTRSH);
-                if (test_bit(wil_status_reset_done, &wil->status)) {
-                        if (test_bit(wil_status_napi_en, &wil->status)) {
+                isr &= ~(BIT_DMA_EP_RX_ICR_RX_DONE |
+                         BIT_DMA_EP_RX_ICR_RX_HTRSH);
+                if (test_bit(wil_status_reset_done, wil->status)) {
+                        if (test_bit(wil_status_napi_en, wil->status)) {
                                 wil_dbg_txrx(wil, "NAPI(Rx) schedule\n");
                                 need_unmask = false;
                                 napi_schedule(&wil->napi_rx);
                         } else {
-                                wil_err(wil, "Got Rx interrupt while "
-                                        "stopping interface\n");
+                                wil_err(wil,
+                                        "Got Rx interrupt while stopping interface\n");
                         }
                 } else {
                         wil_err(wil, "Got Rx interrupt while in reset\n");
@@ -248,7 +325,7 @@ static irqreturn_t wil6210_irq_tx(int irq, void *cookie)
                 isr &= ~BIT_DMA_EP_TX_ICR_TX_DONE;
                 /* clear also all VRING interrupts */
                 isr &= ~(BIT(25) - 1UL);
-                if (test_bit(wil_status_reset_done, &wil->status)) {
+                if (test_bit(wil_status_reset_done, wil->status)) {
                         wil_dbg_txrx(wil, "NAPI(Tx) schedule\n");
                         need_unmask = false;
                         napi_schedule(&wil->napi_tx);
@@ -310,7 +387,7 @@ static irqreturn_t wil6210_irq_misc(int irq, void *cookie)
 
         if (isr & ISR_MISC_FW_ERROR) {
                 wil_err(wil, "Firmware error detected\n");
-                clear_bit(wil_status_fwready, &wil->status);
+                clear_bit(wil_status_fwready, wil->status);
                 /*
                  * do not clear @isr here - we do 2-nd part in thread
                  * there, user space get notified, and it should be done
@@ -321,7 +398,7 @@ static irqreturn_t wil6210_irq_misc(int irq, void *cookie)
         if (isr & ISR_MISC_FW_READY) {
                 wil_dbg_irq(wil, "IRQ: FW ready\n");
                 wil_cache_mbox_regs(wil);
-                set_bit(wil_status_reset_done, &wil->status);
+                set_bit(wil_status_reset_done, wil->status);
                 /**
                  * Actual FW ready indicated by the
                  * WMI_FW_READY_EVENTID
@@ -394,7 +471,7 @@ static irqreturn_t wil6210_thread_irq(int irq, void *cookie)
  */
 static int wil6210_debug_irq_mask(struct wil6210_priv *wil, u32 pseudo_cause)
 {
-        if (!test_bit(wil_status_irqen, &wil->status)) {
+        if (!test_bit(wil_status_irqen, wil->status)) {
                 u32 icm_rx = wil_ioread32_and_clear(wil->csr +
                                 HOSTADDR(RGF_DMA_EP_RX_ICR) +
                                 offsetof(struct RGF_ICR, ICM));
diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c
index 8ff3fe34fe05..b04e0afdcb21 100644
--- a/drivers/net/wireless/ath/wil6210/main.c
+++ b/drivers/net/wireless/ath/wil6210/main.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 Qualcomm Atheros, Inc.
+ * Copyright (c) 2012-2015 Qualcomm Atheros, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -33,15 +33,18 @@ static bool no_fw_load = true;
 module_param(no_fw_load, bool, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(no_fw_load, " do not download FW, use one in on-card flash.");
 
-static unsigned int itr_trsh = WIL6210_ITR_TRSH_DEFAULT;
-
-module_param(itr_trsh, uint, S_IRUGO);
-MODULE_PARM_DESC(itr_trsh, " Interrupt moderation threshold, usecs.");
+/* if not set via modparam, will be set to default value of 1/8 of
+ * rx ring size during init flow
+ */
+unsigned short rx_ring_overflow_thrsh = WIL6210_RX_HIGH_TRSH_INIT;
+module_param(rx_ring_overflow_thrsh, ushort, S_IRUGO);
+MODULE_PARM_DESC(rx_ring_overflow_thrsh,
+                 " RX ring overflow threshold in descriptors.");
 
 /* We allow allocation of more than 1 page buffers to support large packets.
  * It is suboptimal behavior performance wise in case MTU above page size.
  */
-unsigned int mtu_max = TXRX_BUF_LEN_DEFAULT - ETH_HLEN;
+unsigned int mtu_max = TXRX_BUF_LEN_DEFAULT - WIL_MAX_MPDU_OVERHEAD;
 static int mtu_max_set(const char *val, const struct kernel_param *kp)
 {
         int ret;
@@ -53,7 +56,7 @@ static int mtu_max_set(const char *val, const struct kernel_param *kp)
         if (ret)
                 return ret;
 
-        if (mtu_max < 68 || mtu_max > IEEE80211_MAX_DATA_LEN_DMG)
+        if (mtu_max < 68 || mtu_max > WIL_MAX_ETH_MTU)
                 ret = -EINVAL;
 
         return ret;
@@ -135,12 +138,14 @@ void wil_memcpy_toio_32(volatile void __iomem *dst, const void *src,
 
 static void wil_disconnect_cid(struct wil6210_priv *wil, int cid,
                                u16 reason_code, bool from_event)
+__acquires(&sta->tid_rx_lock) __releases(&sta->tid_rx_lock)
 {
         uint i;
         struct net_device *ndev = wil_to_ndev(wil);
         struct wireless_dev *wdev = wil->wdev;
         struct wil_sta_info *sta = &wil->sta[cid];
 
+        might_sleep();
         wil_dbg_misc(wil, "%s(CID %d, status %d)\n", __func__, cid,
                      sta->status);
 
@@ -163,15 +168,14 @@ static void wil_disconnect_cid(struct wil6210_priv *wil, int cid,
 
         for (i = 0; i < WIL_STA_TID_NUM; i++) {
                 struct wil_tid_ampdu_rx *r;
-                unsigned long flags;
 
-                spin_lock_irqsave(&sta->tid_rx_lock, flags);
+                spin_lock_bh(&sta->tid_rx_lock);
 
                 r = sta->tid_rx[i];
                 sta->tid_rx[i] = NULL;
                 wil_tid_ampdu_rx_free(wil, r);
 
-                spin_unlock_irqrestore(&sta->tid_rx_lock, flags);
+                spin_unlock_bh(&sta->tid_rx_lock);
         }
         for (i = 0; i < ARRAY_SIZE(wil->vring_tx); i++) {
                 if (wil->vring2cid_tid[i][0] == cid)
@@ -188,34 +192,47 @@ static void _wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid,
         struct wireless_dev *wdev = wil->wdev;
 
         might_sleep();
-        if (bssid) {
+        wil_dbg_misc(wil, "%s(bssid=%pM, reason=%d, ev%s)\n", __func__, bssid,
+                     reason_code, from_event ? "+" : "-");
+
+        /* Cases are:
+         * - disconnect single STA, still connected
+         * - disconnect single STA, already disconnected
+         * - disconnect all
+         *
+         * For "disconnect all", there are 2 options:
+         * - bssid == NULL
+         * - bssid is our MAC address
+         */
+        if (bssid && memcmp(ndev->dev_addr, bssid, ETH_ALEN)) {
                 cid = wil_find_cid(wil, bssid);
-                wil_dbg_misc(wil, "%s(%pM, CID %d)\n", __func__, bssid, cid);
-        } else {
-                wil_dbg_misc(wil, "%s(all)\n", __func__);
-        }
-
-        if (cid >= 0) /* disconnect 1 peer */
-                wil_disconnect_cid(wil, cid, reason_code, from_event);
-        else /* disconnect all */
+                wil_dbg_misc(wil, "Disconnect %pM, CID=%d, reason=%d\n",
+                             bssid, cid, reason_code);
+                if (cid >= 0) /* disconnect 1 peer */
+                        wil_disconnect_cid(wil, cid, reason_code, from_event);
+        } else { /* all */
+                wil_dbg_misc(wil, "Disconnect all\n");
                 for (cid = 0; cid < WIL6210_MAX_CID; cid++)
                         wil_disconnect_cid(wil, cid, reason_code, from_event);
+        }
 
         /* link state */
         switch (wdev->iftype) {
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_P2P_CLIENT:
-                wil_link_off(wil);
-                if (test_bit(wil_status_fwconnected, &wil->status)) {
-                        clear_bit(wil_status_fwconnected, &wil->status);
+                netif_tx_stop_all_queues(ndev);
+                netif_carrier_off(ndev);
+
+                if (test_bit(wil_status_fwconnected, wil->status)) {
+                        clear_bit(wil_status_fwconnected, wil->status);
                         cfg80211_disconnected(ndev, reason_code,
                                               NULL, 0, GFP_KERNEL);
-                } else if (test_bit(wil_status_fwconnecting, &wil->status)) {
+                } else if (test_bit(wil_status_fwconnecting, wil->status)) {
                         cfg80211_connect_result(ndev, bssid, NULL, 0, NULL, 0,
                                                 WLAN_STATUS_UNSPECIFIED_FAILURE,
                                                 GFP_KERNEL);
                 }
-                clear_bit(wil_status_fwconnecting, &wil->status);
+                clear_bit(wil_status_fwconnecting, wil->status);
                 break;
         default:
                 break;
@@ -248,7 +265,7 @@ static void wil_scan_timer_fn(ulong x)
 {
         struct wil6210_priv *wil = (void *)x;
 
-        clear_bit(wil_status_fwready, &wil->status);
+        clear_bit(wil_status_fwready, wil->status);
         wil_err(wil, "Scan timeout detected, start fw error recovery\n");
         wil->recovery_state = fw_recovery_pending;
         schedule_work(&wil->fw_error_worker);
@@ -352,6 +369,8 @@ static void wil_connect_worker(struct work_struct *work)
         int rc;
         struct wil6210_priv *wil = container_of(work, struct wil6210_priv,
                                                 connect_worker);
+        struct net_device *ndev = wil_to_ndev(wil);
+
         int cid = wil->pending_connect_cid;
         int ringid = wil_find_free_vring(wil);
 
@@ -366,7 +385,7 @@ static void wil_connect_worker(struct work_struct *work)
         wil->pending_connect_cid = -1;
         if (rc == 0) {
                 wil->sta[cid].status = wil_sta_connected;
-                wil_link_on(wil);
+                netif_tx_wake_all_queues(ndev);
         } else {
                 wil->sta[cid].status = wil_sta_unused;
         }
@@ -384,6 +403,9 @@ int wil_priv_init(struct wil6210_priv *wil)
 
         mutex_init(&wil->mutex);
         mutex_init(&wil->wmi_mutex);
+        mutex_init(&wil->back_rx_mutex);
+        mutex_init(&wil->back_tx_mutex);
+        mutex_init(&wil->probe_client_mutex);
 
         init_completion(&wil->wmi_ready);
         init_completion(&wil->wmi_call);
@@ -396,25 +418,39 @@ int wil_priv_init(struct wil6210_priv *wil)
         INIT_WORK(&wil->disconnect_worker, wil_disconnect_worker);
         INIT_WORK(&wil->wmi_event_worker, wmi_event_worker);
         INIT_WORK(&wil->fw_error_worker, wil_fw_error_worker);
+        INIT_WORK(&wil->back_rx_worker, wil_back_rx_worker);
+        INIT_WORK(&wil->back_tx_worker, wil_back_tx_worker);
+        INIT_WORK(&wil->probe_client_worker, wil_probe_client_worker);
 
         INIT_LIST_HEAD(&wil->pending_wmi_ev);
+        INIT_LIST_HEAD(&wil->back_rx_pending);
+        INIT_LIST_HEAD(&wil->back_tx_pending);
+        INIT_LIST_HEAD(&wil->probe_client_pending);
         spin_lock_init(&wil->wmi_ev_lock);
         init_waitqueue_head(&wil->wq);
 
-        wil->wmi_wq = create_singlethread_workqueue(WIL_NAME"_wmi");
+        wil->wmi_wq = create_singlethread_workqueue(WIL_NAME "_wmi");
         if (!wil->wmi_wq)
                 return -EAGAIN;
 
-        wil->wmi_wq_conn = create_singlethread_workqueue(WIL_NAME"_connect");
-        if (!wil->wmi_wq_conn) {
-                destroy_workqueue(wil->wmi_wq);
-                return -EAGAIN;
-        }
+        wil->wq_service = create_singlethread_workqueue(WIL_NAME "_service");
+        if (!wil->wq_service)
+                goto out_wmi_wq;
 
         wil->last_fw_recovery = jiffies;
-        wil->itr_trsh = itr_trsh;
+        wil->tx_interframe_timeout = WIL6210_ITR_TX_INTERFRAME_TIMEOUT_DEFAULT;
+        wil->rx_interframe_timeout = WIL6210_ITR_RX_INTERFRAME_TIMEOUT_DEFAULT;
+        wil->tx_max_burst_duration = WIL6210_ITR_TX_MAX_BURST_DURATION_DEFAULT;
+        wil->rx_max_burst_duration = WIL6210_ITR_RX_MAX_BURST_DURATION_DEFAULT;
 
+        if (rx_ring_overflow_thrsh == WIL6210_RX_HIGH_TRSH_INIT)
+                rx_ring_overflow_thrsh = WIL6210_RX_HIGH_TRSH_DEFAULT;
         return 0;
+
+out_wmi_wq:
+        destroy_workqueue(wil->wmi_wq);
+
+        return -EAGAIN;
 }
 
 /**
@@ -448,7 +484,13 @@ void wil_priv_deinit(struct wil6210_priv *wil)
         wil6210_disconnect(wil, NULL, WLAN_REASON_DEAUTH_LEAVING, false);
         mutex_unlock(&wil->mutex);
         wmi_event_flush(wil);
-        destroy_workqueue(wil->wmi_wq_conn);
+        wil_back_rx_flush(wil);
+        cancel_work_sync(&wil->back_rx_worker);
+        wil_back_tx_flush(wil);
+        cancel_work_sync(&wil->back_tx_worker);
+        wil_probe_client_flush(wil);
+        cancel_work_sync(&wil->probe_client_worker);
+        destroy_workqueue(wil->wq_service);
         destroy_workqueue(wil->wmi_wq);
 }
 
@@ -478,13 +520,10 @@ static int wil_target_reset(struct wil6210_priv *wil)
 {
         int delay = 0;
         u32 x;
-        u32 rev_id;
-        bool is_sparrow = (wil->board->board == WIL_BOARD_SPARROW);
+        bool is_reset_v2 = test_bit(hw_capability_reset_v2,
+                                    wil->hw_capabilities);
 
-        wil_dbg_misc(wil, "Resetting \"%s\"...\n", wil->board->name);
-
-        wil->hw_version = R(RGF_USER_FW_REV_ID);
-        rev_id = wil->hw_version & 0xff;
+        wil_dbg_misc(wil, "Resetting \"%s\"...\n", wil->hw_name);
 
         /* Clear MAC link up */
         S(RGF_HP_CTRL, BIT(15));
@@ -496,7 +535,7 @@ static int wil_target_reset(struct wil6210_priv *wil)
         /* Clear Fw Download notification */
         C(RGF_USER_USAGE_6, BIT(0));
 
-        if (is_sparrow) {
+        if (is_reset_v2) {
                 S(RGF_CAF_OSC_CONTROL, BIT_CAF_OSC_XTAL_EN);
                 /* XTAL stabilization should take about 3ms */
                 usleep_range(5000, 7000);
@@ -517,10 +556,11 @@ static int wil_target_reset(struct wil6210_priv *wil)
 
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0xFE000000);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_1, 0x0000003F);
-        W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, is_sparrow ? 0x000000f0 : 0x00000170);
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_3,
+          is_reset_v2 ? 0x000000f0 : 0x00000170);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_0, 0xFFE7FE00);
 
-        if (is_sparrow) {
+        if (is_reset_v2) {
                 W(RGF_USER_CLKS_CTL_EXT_SW_RST_VEC_0, 0x0);
                 W(RGF_USER_CLKS_CTL_EXT_SW_RST_VEC_1, 0x0);
         }
@@ -530,19 +570,14 @@ static int wil_target_reset(struct wil6210_priv *wil)
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_1, 0);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_0, 0);
 
-        if (is_sparrow) {
+        if (is_reset_v2) {
                 W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0x00000003);
                 /* reset A2 PCIE AHB */
                 W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0x00008000);
         } else {
                 W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0x00000001);
-                if (rev_id == 1) {
-                        /* reset A1 BOTH PCIE AHB & PCIE RGF */
-                        W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0x00000080);
-                } else {
-                        W(RGF_PCIE_LOS_COUNTER_CTL, BIT(6) | BIT(8));
-                        W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0x00008000);
-                }
+                W(RGF_PCIE_LOS_COUNTER_CTL, BIT(6) | BIT(8));
+                W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0x00008000);
         }
 
         /* TODO: check order here!!! Erez code is different */
@@ -559,8 +594,7 @@ static int wil_target_reset(struct wil6210_priv *wil)
                 }
         } while (x != HW_MACHINE_BOOT_DONE);
 
-        /* TODO: Erez check rev_id != 1 */
-        if (!is_sparrow && (rev_id != 1))
+        if (!is_reset_v2)
                 W(RGF_PCIE_LOS_COUNTER_CTL, BIT(8));
 
         C(RGF_USER_CLKS_CTL_0, BIT_USER_CLKS_RST_PWGD);
@@ -569,26 +603,6 @@ static int wil_target_reset(struct wil6210_priv *wil)
         return 0;
 }
 
-/**
- * wil_set_itr_trsh: - apply interrupt coalescing params
- */
-void wil_set_itr_trsh(struct wil6210_priv *wil)
-{
-        /* disable, use usec resolution */
-        W(RGF_DMA_ITR_CNT_CRL, BIT_DMA_ITR_CNT_CRL_EXT_TICK);
-
-        /* disable interrupt moderation for monitor
-         * to get better timestamp precision
-         */
-        if (wil->wdev->iftype == NL80211_IFTYPE_MONITOR)
-                return;
-
-        wil_info(wil, "set ITR_TRSH = %d usec\n", wil->itr_trsh);
-        W(RGF_DMA_ITR_CNT_TRSH, wil->itr_trsh);
-        W(RGF_DMA_ITR_CNT_CRL, BIT_DMA_ITR_CNT_CRL_EN |
-          BIT_DMA_ITR_CNT_CRL_EXT_TICK); /* start it */
-}
-
 #undef R
 #undef W
 #undef S
@@ -629,13 +643,17 @@ int wil_reset(struct wil6210_priv *wil)
 
         wil_dbg_misc(wil, "%s()\n", __func__);
 
+        if (wil->hw_version == HW_VER_UNKNOWN)
+                return -ENODEV;
+
         WARN_ON(!mutex_is_locked(&wil->mutex));
-        WARN_ON(test_bit(wil_status_napi_en, &wil->status));
+        WARN_ON(test_bit(wil_status_napi_en, wil->status));
 
         cancel_work_sync(&wil->disconnect_worker);
         wil6210_disconnect(wil, NULL, WLAN_REASON_DEAUTH_LEAVING, false);
 
-        wil->status = 0; /* prevent NAPI from being scheduled */
+        /* prevent NAPI from being scheduled */
+        bitmap_zero(wil->status, wil_status_last);
 
         if (wil->scan_request) {
                 wil_dbg_misc(wil, "Abort scan_request 0x%p\n",
@@ -649,7 +667,7 @@ int wil_reset(struct wil6210_priv *wil)
 
         wmi_event_flush(wil);
 
-        flush_workqueue(wil->wmi_wq_conn);
+        flush_workqueue(wil->wq_service);
         flush_workqueue(wil->wmi_wq);
 
         rc = wil_target_reset(wil);
@@ -688,6 +706,7 @@ int wil_reset(struct wil6210_priv *wil)
         reinit_completion(&wil->wmi_ready);
         reinit_completion(&wil->wmi_call);
 
+        wil_configure_interrupt_moderation(wil);
         wil_unmask_irq(wil);
 
         /* we just started MAC, wait for FW ready */
@@ -703,28 +722,6 @@ void wil_fw_error_recovery(struct wil6210_priv *wil)
         schedule_work(&wil->fw_error_worker);
 }
 
-void wil_link_on(struct wil6210_priv *wil)
-{
-        struct net_device *ndev = wil_to_ndev(wil);
-
-        wil_dbg_misc(wil, "%s()\n", __func__);
-
-        netif_carrier_on(ndev);
-        wil_dbg_misc(wil, "netif_tx_wake : link on\n");
-        netif_tx_wake_all_queues(ndev);
-}
-
-void wil_link_off(struct wil6210_priv *wil)
-{
-        struct net_device *ndev = wil_to_ndev(wil);
-
-        wil_dbg_misc(wil, "%s()\n", __func__);
-
-        netif_tx_stop_all_queues(ndev);
-        wil_dbg_misc(wil, "netif_tx_stop : link off\n");
-        netif_carrier_off(ndev);
-}
-
 int __wil_up(struct wil6210_priv *wil)
 {
         struct net_device *ndev = wil_to_ndev(wil);
@@ -774,7 +771,7 @@ int __wil_up(struct wil6210_priv *wil)
         wil_dbg_misc(wil, "NAPI enable\n");
         napi_enable(&wil->napi_rx);
         napi_enable(&wil->napi_tx);
-        set_bit(wil_status_napi_en, &wil->status);
+        set_bit(wil_status_napi_en, wil->status);
 
         if (wil->platform_ops.bus_request)
                 wil->platform_ops.bus_request(wil->platform_handle,
@@ -807,7 +804,7 @@ int __wil_down(struct wil6210_priv *wil)
                 wil->platform_ops.bus_request(wil->platform_handle, 0);
 
         wil_disable_irq(wil);
-        if (test_and_clear_bit(wil_status_napi_en, &wil->status)) {
+        if (test_and_clear_bit(wil_status_napi_en, wil->status)) {
                 napi_disable(&wil->napi_rx);
                 napi_disable(&wil->napi_tx);
                 wil_dbg_misc(wil, "NAPI disable\n");
@@ -822,15 +819,15 @@ int __wil_down(struct wil6210_priv *wil)
                 wil->scan_request = NULL;
         }
 
-        if (test_bit(wil_status_fwconnected, &wil->status) ||
-            test_bit(wil_status_fwconnecting, &wil->status))
+        if (test_bit(wil_status_fwconnected, wil->status) ||
+            test_bit(wil_status_fwconnecting, wil->status))
                 wmi_send(wil, WMI_DISCONNECT_CMDID, NULL, 0);
 
         /* make sure wil is idle (not connected) */
         mutex_unlock(&wil->mutex);
         while (iter--) {
-                int idle = !test_bit(wil_status_fwconnected, &wil->status) &&
-                           !test_bit(wil_status_fwconnecting, &wil->status);
+                int idle = !test_bit(wil_status_fwconnected, wil->status) &&
+                           !test_bit(wil_status_fwconnecting, wil->status);
                 if (idle)
                         break;
                 msleep(WAIT_FOR_DISCONNECT_INTERVAL_MS);
diff --git a/drivers/net/wireless/ath/wil6210/netdev.c b/drivers/net/wireless/ath/wil6210/netdev.c
index e81703ca7701..ace30c1b5c64 100644
--- a/drivers/net/wireless/ath/wil6210/netdev.c
+++ b/drivers/net/wireless/ath/wil6210/netdev.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 Qualcomm Atheros, Inc.
+ * Copyright (c) 2012-2015 Qualcomm Atheros, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,6 @@
  */
 
 #include <linux/etherdevice.h>
-
 #include "wil6210.h"
 #include "txrx.h"
 
@@ -122,6 +121,12 @@ static int wil6210_netdev_poll_tx(struct napi_struct *napi, int budget)
         return min(tx_done, budget);
 }
 
+static void wil_dev_setup(struct net_device *dev)
+{
+        ether_setup(dev);
+        dev->tx_queue_len = WIL_TX_Q_LEN_DEFAULT;
+}
+
 void *wil_if_alloc(struct device *dev, void __iomem *csr)
 {
         struct net_device *ndev;
@@ -153,7 +158,7 @@ void *wil_if_alloc(struct device *dev, void __iomem *csr)
         ch = wdev->wiphy->bands[IEEE80211_BAND_60GHZ]->channels;
         cfg80211_chandef_create(&wdev->preset_chandef, ch, NL80211_CHAN_NO_HT);
 
-        ndev = alloc_netdev(0, "wlan%d", NET_NAME_UNKNOWN, ether_setup);
+        ndev = alloc_netdev(0, "wlan%d", NET_NAME_UNKNOWN, wil_dev_setup);
         if (!ndev) {
                 dev_err(dev, "alloc_netdev_mqs failed\n");
                 rc = -ENOMEM;
@@ -174,7 +179,7 @@ void *wil_if_alloc(struct device *dev, void __iomem *csr)
         netif_napi_add(ndev, &wil->napi_tx, wil6210_netdev_poll_tx,
                        WIL6210_NAPI_BUDGET);
 
-        wil_link_off(wil);
+        netif_tx_stop_all_queues(ndev);
 
         return wil;
 
@@ -217,8 +222,6 @@ int wil_if_add(struct wil6210_priv *wil)
                 return rc;
         }
 
-        wil_link_off(wil);
-
         return 0;
 }
 
diff --git a/drivers/net/wireless/ath/wil6210/pcie_bus.c b/drivers/net/wireless/ath/wil6210/pcie_bus.c
index 66626a8ee728..3dd26709ccb2 100644
--- a/drivers/net/wireless/ath/wil6210/pcie_bus.c
+++ b/drivers/net/wireless/ath/wil6210/pcie_bus.c
@@ -31,6 +31,46 @@ static bool debug_fw; /* = false; */
 module_param(debug_fw, bool, S_IRUGO);
 MODULE_PARM_DESC(debug_fw, " load driver if FW not ready. For FW debug");
 
+static
+void wil_set_capabilities(struct wil6210_priv *wil)
+{
+        u32 rev_id = ioread32(wil->csr + HOSTADDR(RGF_USER_JTAG_DEV_ID));
+
+        bitmap_zero(wil->hw_capabilities, hw_capability_last);
+
+        switch (rev_id) {
+        case JTAG_DEV_ID_MARLON_B0:
+                wil->hw_name = "Marlon B0";
+                wil->hw_version = HW_VER_MARLON_B0;
+                break;
+        case JTAG_DEV_ID_SPARROW_A0:
+                wil->hw_name = "Sparrow A0";
+                wil->hw_version = HW_VER_SPARROW_A0;
+                break;
+        case JTAG_DEV_ID_SPARROW_A1:
+                wil->hw_name = "Sparrow A1";
+                wil->hw_version = HW_VER_SPARROW_A1;
+                break;
+        case JTAG_DEV_ID_SPARROW_B0:
+                wil->hw_name = "Sparrow B0";
+                wil->hw_version = HW_VER_SPARROW_B0;
+                break;
+        default:
+                wil_err(wil, "Unknown board hardware 0x%08x\n", rev_id);
+                wil->hw_name = "Unknown";
+                wil->hw_version = HW_VER_UNKNOWN;
+        }
+
+        wil_info(wil, "Board hardware is %s\n", wil->hw_name);
+
+        if (wil->hw_version >= HW_VER_SPARROW_A0)
+                set_bit(hw_capability_reset_v2, wil->hw_capabilities);
+
+        if (wil->hw_version >= HW_VER_SPARROW_B0)
+                set_bit(hw_capability_advanced_itr_moderation,
+                        wil->hw_capabilities);
+}
+
 void wil_disable_irq(struct wil6210_priv *wil)
 {
         int irq = wil->pdev->irq;
@@ -149,12 +189,11 @@ static int wil_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         struct wil6210_priv *wil;
         struct device *dev = &pdev->dev;
         void __iomem *csr;
-        struct wil_board *board = (struct wil_board *)id->driver_data;
         int rc;
 
         /* check HW */
         dev_info(&pdev->dev, WIL_NAME
-                 " \"%s\" device found [%04x:%04x] (rev %x)\n", board->name,
+                 " device found [%04x:%04x] (rev %x)\n",
                  (int)pdev->vendor, (int)pdev->device, (int)pdev->revision);
 
         if (pci_resource_len(pdev, 0) != WIL6210_MEM_SIZE) {
@@ -204,8 +243,7 @@ static int wil_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 
         pci_set_drvdata(pdev, wil);
         wil->pdev = pdev;
-        wil->board = board;
-
+        wil_set_capabilities(wil);
         wil6210_clear_irq(wil);
 
         wil->platform_handle =
@@ -266,23 +304,10 @@ static void wil_pcie_remove(struct pci_dev *pdev)
         pci_disable_device(pdev);
 }
 
-static const struct wil_board wil_board_marlon = {
-        .board = WIL_BOARD_MARLON,
-        .name = "marlon",
-};
-
-static const struct wil_board wil_board_sparrow = {
-        .board = WIL_BOARD_SPARROW,
-        .name = "sparrow",
-};
-
 static const struct pci_device_id wil6210_pcie_ids[] = {
-        { PCI_DEVICE(0x1ae9, 0x0301),
-          .driver_data = (kernel_ulong_t)&wil_board_marlon },
-        { PCI_DEVICE(0x1ae9, 0x0310),
-          .driver_data = (kernel_ulong_t)&wil_board_sparrow },
-        { PCI_DEVICE(0x1ae9, 0x0302), /* same as above, firmware broken */
-          .driver_data = (kernel_ulong_t)&wil_board_sparrow },
+        { PCI_DEVICE(0x1ae9, 0x0301) },
+        { PCI_DEVICE(0x1ae9, 0x0310) },
+        { PCI_DEVICE(0x1ae9, 0x0302) }, /* same as above, firmware broken */
         { /* end: all zeroes */ },
 };
 MODULE_DEVICE_TABLE(pci, wil6210_pcie_ids);
diff --git a/drivers/net/wireless/ath/wil6210/rx_reorder.c b/drivers/net/wireless/ath/wil6210/rx_reorder.c
index 489cb73d139b..ca10dcf0986e 100644
--- a/drivers/net/wireless/ath/wil6210/rx_reorder.c
+++ b/drivers/net/wireless/ath/wil6210/rx_reorder.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014 Qualcomm Atheros, Inc.
+ * Copyright (c) 2014-2015 Qualcomm Atheros, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -89,7 +89,9 @@ static void wil_reorder_release(struct wil6210_priv *wil,
         }
 }
 
+/* called in NAPI context */
 void wil_rx_reorder(struct wil6210_priv *wil, struct sk_buff *skb)
+__acquires(&sta->tid_rx_lock) __releases(&sta->tid_rx_lock)
 {
         struct net_device *ndev = wil_to_ndev(wil);
         struct vring_rx_desc *d = wil_skb_rxdesc(skb);
@@ -97,22 +99,26 @@ void wil_rx_reorder(struct wil6210_priv *wil, struct sk_buff *skb)
         int cid = wil_rxdesc_cid(d);
         int mid = wil_rxdesc_mid(d);
         u16 seq = wil_rxdesc_seq(d);
+        int mcast = wil_rxdesc_mcast(d);
         struct wil_sta_info *sta = &wil->sta[cid];
         struct wil_tid_ampdu_rx *r;
         u16 hseq;
         int index;
-        unsigned long flags;
 
-        wil_dbg_txrx(wil, "MID %d CID %d TID %d Seq 0x%03x\n",
-                     mid, cid, tid, seq);
+        wil_dbg_txrx(wil, "MID %d CID %d TID %d Seq 0x%03x mcast %01x\n",
+                     mid, cid, tid, seq, mcast);
 
-        spin_lock_irqsave(&sta->tid_rx_lock, flags);
+        if (unlikely(mcast)) {
+                wil_netif_rx_any(skb, ndev);
+                return;
+        }
+
+        spin_lock(&sta->tid_rx_lock);
 
         r = sta->tid_rx[tid];
         if (!r) {
-                spin_unlock_irqrestore(&sta->tid_rx_lock, flags);
                 wil_netif_rx_any(skb, ndev);
-                return;
+                goto out;
         }
 
         hseq = r->head_seq_num;
@@ -121,13 +127,24 @@ void wil_rx_reorder(struct wil6210_priv *wil, struct sk_buff *skb)
          * reported, and data Rx, few packets may be pass up before reorder
          * buffer get allocated. Catch up by pretending SSN is what we
          * see in the 1-st Rx packet
+         *
+         * Another scenario, Rx get delayed and we got packet from before
+         * BACK. Pass it to the stack and wait.
          */
         if (r->first_time) {
                 r->first_time = false;
                 if (seq != r->head_seq_num) {
-                        wil_err(wil, "Error: 1-st frame with wrong sequence"
-                                " %d, should be %d. Fixing...\n", seq,
-                                r->head_seq_num);
+                        if (seq_less(seq, r->head_seq_num)) {
+                                wil_err(wil,
+                                        "Error: frame with early sequence 0x%03x, should be 0x%03x. Waiting...\n",
+                                        seq, r->head_seq_num);
+                                r->first_time = true;
+                                wil_netif_rx_any(skb, ndev);
+                                goto out;
+                        }
+                        wil_err(wil,
+                                "Error: 1-st frame with wrong sequence 0x%03x, should be 0x%03x. Fixing...\n",
+                                seq, r->head_seq_num);
                         r->head_seq_num = seq;
                         r->ssn = seq;
                 }
@@ -179,7 +196,7 @@ void wil_rx_reorder(struct wil6210_priv *wil, struct sk_buff *skb)
         wil_reorder_release(wil, r);
 
 out:
-        spin_unlock_irqrestore(&sta->tid_rx_lock, flags);
+        spin_unlock(&sta->tid_rx_lock);
 }
 
 struct wil_tid_ampdu_rx *wil_tid_ampdu_rx_alloc(struct wil6210_priv *wil,
@@ -219,3 +236,241 @@ void wil_tid_ampdu_rx_free(struct wil6210_priv *wil,
         kfree(r->reorder_time);
         kfree(r);
 }
+
+/* ADDBA processing */
+static u16 wil_agg_size(struct wil6210_priv *wil, u16 req_agg_wsize)
+{
+        u16 max_agg_size = min_t(u16, WIL_MAX_AGG_WSIZE, WIL_MAX_AMPDU_SIZE /
+                                 (mtu_max + WIL_MAX_MPDU_OVERHEAD));
+
+        if (!req_agg_wsize)
+                return max_agg_size;
+
+        return min(max_agg_size, req_agg_wsize);
+}
+
+/* Block Ack - Rx side (recipient */
+int wil_addba_rx_request(struct wil6210_priv *wil, u8 cidxtid,
+                         u8 dialog_token, __le16 ba_param_set,
+                         __le16 ba_timeout, __le16 ba_seq_ctrl)
+{
+        struct wil_back_rx *req = kzalloc(sizeof(*req), GFP_KERNEL);
+
+        if (!req)
+                return -ENOMEM;
+
+        req->cidxtid = cidxtid;
+        req->dialog_token = dialog_token;
+        req->ba_param_set = le16_to_cpu(ba_param_set);
+        req->ba_timeout = le16_to_cpu(ba_timeout);
+        req->ba_seq_ctrl = le16_to_cpu(ba_seq_ctrl);
+
+        mutex_lock(&wil->back_rx_mutex);
+        list_add_tail(&req->list, &wil->back_rx_pending);
+        mutex_unlock(&wil->back_rx_mutex);
+
+        queue_work(wil->wq_service, &wil->back_rx_worker);
+
+        return 0;
+}
+
+static void wil_back_rx_handle(struct wil6210_priv *wil,
+                               struct wil_back_rx *req)
+__acquires(&sta->tid_rx_lock) __releases(&sta->tid_rx_lock)
+{
+        struct wil_sta_info *sta;
+        u8 cid, tid;
+        u16 agg_wsize = 0;
+        /* bit 0: A-MSDU supported
+         * bit 1: policy (should be 0 for us)
+         * bits 2..5: TID
+         * bits 6..15: buffer size
+         */
+        u16 req_agg_wsize = WIL_GET_BITS(req->ba_param_set, 6, 15);
+        bool agg_amsdu = !!(req->ba_param_set & BIT(0));
+        int ba_policy = req->ba_param_set & BIT(1);
+        u16 agg_timeout = req->ba_timeout;
+        u16 status = WLAN_STATUS_SUCCESS;
+        u16 ssn = req->ba_seq_ctrl >> 4;
+        struct wil_tid_ampdu_rx *r;
+        int rc;
+
+        might_sleep();
+        parse_cidxtid(req->cidxtid, &cid, &tid);
+
+        /* sanity checks */
+        if (cid >= WIL6210_MAX_CID) {
+                wil_err(wil, "BACK: invalid CID %d\n", cid);
+                return;
+        }
+
+        sta = &wil->sta[cid];
+        if (sta->status != wil_sta_connected) {
+                wil_err(wil, "BACK: CID %d not connected\n", cid);
+                return;
+        }
+
+        wil_dbg_wmi(wil,
+                    "ADDBA request for CID %d %pM TID %d size %d timeout %d AMSDU%s policy %d token %d SSN 0x%03x\n",
+                    cid, sta->addr, tid, req_agg_wsize, req->ba_timeout,
+                    agg_amsdu ? "+" : "-", !!ba_policy, req->dialog_token, ssn);
+
+        /* apply policies */
+        if (ba_policy) {
+                wil_err(wil, "BACK requested unsupported ba_policy == 1\n");
+                status = WLAN_STATUS_INVALID_QOS_PARAM;
+        }
+        if (status == WLAN_STATUS_SUCCESS)
+                agg_wsize = wil_agg_size(wil, req_agg_wsize);
+
+        rc = wmi_addba_rx_resp(wil, cid, tid, req->dialog_token, status,
+                               agg_amsdu, agg_wsize, agg_timeout);
+        if (rc || (status != WLAN_STATUS_SUCCESS))
+                return;
+
+        /* apply */
+        r = wil_tid_ampdu_rx_alloc(wil, agg_wsize, ssn);
+        spin_lock_bh(&sta->tid_rx_lock);
+        wil_tid_ampdu_rx_free(wil, sta->tid_rx[tid]);
+        sta->tid_rx[tid] = r;
+        spin_unlock_bh(&sta->tid_rx_lock);
+}
+
+void wil_back_rx_flush(struct wil6210_priv *wil)
+{
+        struct wil_back_rx *evt, *t;
+
+        wil_dbg_misc(wil, "%s()\n", __func__);
+
+        mutex_lock(&wil->back_rx_mutex);
+
+        list_for_each_entry_safe(evt, t, &wil->back_rx_pending, list) {
+                list_del(&evt->list);
+                kfree(evt);
+        }
+
+        mutex_unlock(&wil->back_rx_mutex);
+}
+
+/* Retrieve next ADDBA request from the pending list */
+static struct list_head *next_back_rx(struct wil6210_priv *wil)
+{
+        struct list_head *ret = NULL;
+
+        mutex_lock(&wil->back_rx_mutex);
+
+        if (!list_empty(&wil->back_rx_pending)) {
+                ret = wil->back_rx_pending.next;
+                list_del(ret);
+        }
+
+        mutex_unlock(&wil->back_rx_mutex);
+
+        return ret;
+}
+
+void wil_back_rx_worker(struct work_struct *work)
+{
+        struct wil6210_priv *wil = container_of(work, struct wil6210_priv,
+                                                back_rx_worker);
+        struct wil_back_rx *evt;
+        struct list_head *lh;
+
+        while ((lh = next_back_rx(wil)) != NULL) {
+                evt = list_entry(lh, struct wil_back_rx, list);
+
+                wil_back_rx_handle(wil, evt);
+                kfree(evt);
+        }
+}
+
+/* BACK - Tx (originator) side */
+static void wil_back_tx_handle(struct wil6210_priv *wil,
+                               struct wil_back_tx *req)
+{
+        struct vring_tx_data *txdata = &wil->vring_tx_data[req->ringid];
+        int rc;
+
+        if (txdata->addba_in_progress) {
+                wil_dbg_misc(wil, "ADDBA for vring[%d] already in progress\n",
+                             req->ringid);
+                return;
+        }
+        if (txdata->agg_wsize) {
+                wil_dbg_misc(wil,
+                             "ADDBA for vring[%d] already established wsize %d\n",
+                             req->ringid, txdata->agg_wsize);
+                return;
+        }
+        txdata->addba_in_progress = true;
+        rc = wmi_addba(wil, req->ringid, req->agg_wsize, req->agg_timeout);
+        if (rc)
+                txdata->addba_in_progress = false;
+}
+
+static struct list_head *next_back_tx(struct wil6210_priv *wil)
+{
+        struct list_head *ret = NULL;
+
+        mutex_lock(&wil->back_tx_mutex);
+
+        if (!list_empty(&wil->back_tx_pending)) {
+                ret = wil->back_tx_pending.next;
+                list_del(ret);
+        }
+
+        mutex_unlock(&wil->back_tx_mutex);
+
+        return ret;
+}
+
+void wil_back_tx_worker(struct work_struct *work)
+{
+        struct wil6210_priv *wil = container_of(work, struct wil6210_priv,
+                                                 back_tx_worker);
+        struct wil_back_tx *evt;
+        struct list_head *lh;
+
+        while ((lh = next_back_tx(wil)) != NULL) {
+                evt = list_entry(lh, struct wil_back_tx, list);
+
+                wil_back_tx_handle(wil, evt);
+                kfree(evt);
+        }
+}
+
+void wil_back_tx_flush(struct wil6210_priv *wil)
+{
+        struct wil_back_tx *evt, *t;
+
+        wil_dbg_misc(wil, "%s()\n", __func__);
+
+        mutex_lock(&wil->back_tx_mutex);
+
+        list_for_each_entry_safe(evt, t, &wil->back_tx_pending, list) {
+                list_del(&evt->list);
+                kfree(evt);
+        }
+
+        mutex_unlock(&wil->back_tx_mutex);
+}
+
+int wil_addba_tx_request(struct wil6210_priv *wil, u8 ringid, u16 wsize)
+{
+        struct wil_back_tx *req = kzalloc(sizeof(*req), GFP_KERNEL);
+
+        if (!req)
+                return -ENOMEM;
+
+        req->ringid = ringid;
+        req->agg_wsize = wil_agg_size(wil, wsize);
+        req->agg_timeout = 0;
+
+        mutex_lock(&wil->back_tx_mutex);
+        list_add_tail(&req->list, &wil->back_tx_pending);
+        mutex_unlock(&wil->back_tx_mutex);
+
+        queue_work(wil->wq_service, &wil->back_tx_worker);
+
+        return 0;
+}
diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
index e3f8bdce5abc..8439f65db259 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.c
+++ b/drivers/net/wireless/ath/wil6210/txrx.c
@@ -463,7 +463,7 @@ static struct sk_buff *wil_vring_reap_rx(struct wil6210_priv *wil,
          * and in case of error drop the packet
          * higher stack layers will handle retransmission (if required)
          */
-        if (d->dma.status & RX_DMA_STATUS_L4_IDENT) {
+        if (d->dma.status & RX_DMA_STATUS_L4I) {
                 /* L4 protocol identified, csum calculated */
                 if ((d->dma.error & RX_DMA_ERROR_L4_ERR) == 0)
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -581,14 +581,8 @@ void wil_rx_handle(struct wil6210_priv *wil, int *quota)
                         skb->protocol = htons(ETH_P_802_2);
                         wil_netif_rx_any(skb, ndev);
                 } else {
-                        struct ethhdr *eth = (void *)skb->data;
-
                         skb->protocol = eth_type_trans(skb, ndev);
-
-                        if (is_unicast_ether_addr(eth->h_dest))
-                                wil_rx_reorder(wil, skb);
-                        else
-                                wil_netif_rx_any(skb, ndev);
+                        wil_rx_reorder(wil, skb);
                 }
         }
         wil_rx_refill(wil, v->size);
@@ -645,7 +639,7 @@ int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
                 .vring_cfg = {
                         .tx_sw_ring = {
                                 .max_mpdu_size =
-                                        cpu_to_le16(mtu_max + ETH_HLEN),
+                                        cpu_to_le16(wil_mtu2macbuf(mtu_max)),
                                 .ring_size = cpu_to_le16(size),
                         },
                         .ringid = id,
@@ -653,7 +647,7 @@ int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
                         .encap_trans_type = WMI_VRING_ENC_TYPE_802_3,
                         .mac_ctrl = 0,
                         .to_resolution = 0,
-                        .agg_max_wsize = 16,
+                        .agg_max_wsize = 0,
                         .schd_params = {
                                 .priority = cpu_to_le16(0),
                                 .timeslot_us = cpu_to_le16(0xfff),
@@ -677,6 +671,7 @@ int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
         }
 
         memset(txdata, 0, sizeof(*txdata));
+        spin_lock_init(&txdata->lock);
         vring->size = size;
         rc = wil_vring_alloc(wil, vring);
         if (rc)
@@ -701,6 +696,8 @@ int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
         vring->hwtail = le32_to_cpu(reply.cmd.tx_vring_tail_ptr);
 
         txdata->enabled = 1;
+        if (wil->sta[cid].data_port_open && (agg_wsize >= 0))
+                wil_addba_tx_request(wil, id, agg_wsize);
 
         return 0;
  out_free:
@@ -713,6 +710,7 @@ int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
 void wil_vring_fini_tx(struct wil6210_priv *wil, int id)
 {
         struct vring *vring = &wil->vring_tx[id];
+        struct vring_tx_data *txdata = &wil->vring_tx_data[id];
 
         WARN_ON(!mutex_is_locked(&wil->mutex));
 
@@ -721,12 +719,15 @@ void wil_vring_fini_tx(struct wil6210_priv *wil, int id)
 
         wil_dbg_misc(wil, "%s() id=%d\n", __func__, id);
 
+        spin_lock_bh(&txdata->lock);
+        txdata->enabled = 0; /* no Tx can be in progress or start anew */
+        spin_unlock_bh(&txdata->lock);
         /* make sure NAPI won't touch this vring */
-        wil->vring_tx_data[id].enabled = 0;
-        if (test_bit(wil_status_napi_en, &wil->status))
+        if (test_bit(wil_status_napi_en, wil->status))
                 napi_synchronize(&wil->napi_tx);
 
         wil_vring_free(wil, vring, 1);
+        memset(txdata, 0, sizeof(*txdata));
 }
 
 static struct vring *wil_find_tx_vring(struct wil6210_priv *wil,
@@ -773,6 +774,38 @@ static void wil_set_da_for_vring(struct wil6210_priv *wil,
 
 static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
                         struct sk_buff *skb);
+
+static struct vring *wil_find_tx_vring_sta(struct wil6210_priv *wil,
+                                           struct sk_buff *skb)
+{
+        struct vring *v;
+        int i;
+        u8 cid;
+
+        /* In the STA mode, it is expected to have only 1 VRING
+         * for the AP we connected to.
+         * find 1-st vring and see whether it is eligible for data
+         */
+        for (i = 0; i < WIL6210_MAX_TX_RINGS; i++) {
+                v = &wil->vring_tx[i];
+                if (!v->va)
+                        continue;
+
+                cid = wil->vring2cid_tid[i][0];
+                if (!wil->sta[cid].data_port_open &&
+                    (skb->protocol != cpu_to_be16(ETH_P_PAE)))
+                        break;
+
+                wil_dbg_txrx(wil, "Tx -> ring %d\n", i);
+
+                return v;
+        }
+
+        wil_dbg_txrx(wil, "Tx while no vrings active?\n");
+
+        return NULL;
+}
+
 /*
  * Find 1-st vring and return it; set dest address for this vring in skb
  * duplicate skb and send it to other active vrings
@@ -843,9 +876,6 @@ static int wil_tx_desc_map(struct vring_tx_desc *d, dma_addr_t pa, u32 len,
         d->mac.d[1] = 0;
         d->mac.d[2] = 0;
         d->mac.ucode_cmd = 0;
-        /* use dst index 0 */
-        d->mac.d[1] |= BIT(MAC_CFG_DESC_TX_1_DST_INDEX_EN_POS) |
-                       (0 << MAC_CFG_DESC_TX_1_DST_INDEX_POS);
         /* translation type:  0 - bypass; 1 - 802.3; 2 - native wifi */
         d->mac.d[2] = BIT(MAC_CFG_DESC_TX_2_SNAP_HDR_INSERTION_EN_POS) |
                       (1 << MAC_CFG_DESC_TX_2_L2_TRANSLATION_TYPE_POS);
@@ -908,8 +938,8 @@ static int wil_tx_desc_offload_cksum_set(struct wil6210_priv *wil,
         return 0;
 }
 
-static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
-                        struct sk_buff *skb)
+static int __wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
+                          struct sk_buff *skb)
 {
         struct device *dev = wil_to_dev(wil);
         struct vring_tx_desc dd, *d = &dd;
@@ -925,18 +955,21 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
 
         wil_dbg_txrx(wil, "%s()\n", __func__);
 
+        if (unlikely(!txdata->enabled))
+                return -EINVAL;
+
         if (avail < 1 + nr_frags) {
                 wil_err_ratelimited(wil,
-                                    "Tx ring full. No space for %d fragments\n",
-                                    1 + nr_frags);
+                                    "Tx ring[%2d] full. No space for %d fragments\n",
+                                    vring_index, 1 + nr_frags);
                 return -ENOMEM;
         }
         _d = &vring->va[i].tx;
 
         pa = dma_map_single(dev, skb->data, skb_headlen(skb), DMA_TO_DEVICE);
 
-        wil_dbg_txrx(wil, "Tx skb %d bytes 0x%p -> %pad\n", skb_headlen(skb),
-                     skb->data, &pa);
+        wil_dbg_txrx(wil, "Tx[%2d] skb %d bytes 0x%p -> %pad\n", vring_index,
+                     skb_headlen(skb), skb->data, &pa);
         wil_hex_dump_txrx("Tx ", DUMP_PREFIX_OFFSET, 16, 1,
                           skb->data, skb_headlen(skb), false);
 
@@ -947,15 +980,13 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
         wil_tx_desc_map(d, pa, skb_headlen(skb), vring_index);
         /* Process TCP/UDP checksum offloading */
         if (wil_tx_desc_offload_cksum_set(wil, d, skb)) {
-                wil_err(wil, "VRING #%d Failed to set cksum, drop packet\n",
+                wil_err(wil, "Tx[%2d] Failed to set cksum, drop packet\n",
                         vring_index);
                 goto dma_error;
         }
 
         vring->ctx[i].nr_frags = nr_frags;
         wil_tx_desc_set_nr_frags(d, nr_frags);
-        if (nr_frags)
-                *_d = *d;
 
         /* middle segments */
         for (; f < nr_frags; f++) {
@@ -963,6 +994,10 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
                                 &skb_shinfo(skb)->frags[f];
                 int len = skb_frag_size(frag);
 
+                *_d = *d;
+                wil_dbg_txrx(wil, "Tx[%2d] desc[%4d]\n", vring_index, i);
+                wil_hex_dump_txrx("TxD ", DUMP_PREFIX_NONE, 32, 4,
+                                  (const void *)d, sizeof(*d), false);
                 i = (swhead + f + 1) % vring->size;
                 _d = &vring->va[i].tx;
                 pa = skb_frag_dma_map(dev, frag, 0, skb_frag_size(frag),
@@ -976,13 +1011,15 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
                  * it will succeed here too
                  */
                 wil_tx_desc_offload_cksum_set(wil, d, skb);
-                *_d = *d;
         }
         /* for the last seg only */
         d->dma.d0 |= BIT(DMA_CFG_DESC_TX_0_CMD_EOP_POS);
         d->dma.d0 |= BIT(DMA_CFG_DESC_TX_0_CMD_MARK_WB_POS);
         d->dma.d0 |= BIT(DMA_CFG_DESC_TX_0_CMD_DMA_IT_POS);
         *_d = *d;
+        wil_dbg_txrx(wil, "Tx[%2d] desc[%4d]\n", vring_index, i);
+        wil_hex_dump_txrx("TxD ", DUMP_PREFIX_NONE, 32, 4,
+                          (const void *)d, sizeof(*d), false);
 
         /* hold reference to skb
          * to prevent skb release before accounting
@@ -990,15 +1027,13 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
          */
         vring->ctx[i].skb = skb_get(skb);
 
-        wil_hex_dump_txrx("Tx ", DUMP_PREFIX_NONE, 32, 4,
-                          (const void *)d, sizeof(*d), false);
-
         if (wil_vring_is_empty(vring)) /* performance monitoring */
                 txdata->idle += get_cycles() - txdata->last_idle;
 
         /* advance swhead */
         wil_vring_advance_head(vring, nr_frags + 1);
-        wil_dbg_txrx(wil, "Tx swhead %d -> %d\n", swhead, vring->swhead);
+        wil_dbg_txrx(wil, "Tx[%2d] swhead %d -> %d\n", vring_index, swhead,
+                     vring->swhead);
         trace_wil6210_tx(vring_index, swhead, skb->len, nr_frags);
         iowrite32(vring->swhead, wil->csr + HOSTADDR(vring->hwtail));
 
@@ -1025,6 +1060,19 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
         return -EINVAL;
 }
 
+static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
+                        struct sk_buff *skb)
+{
+        int vring_index = vring - wil->vring_tx;
+        struct vring_tx_data *txdata = &wil->vring_tx_data[vring_index];
+        int rc;
+
+        spin_lock(&txdata->lock);
+        rc = __wil_tx_vring(wil, vring, skb);
+        spin_unlock(&txdata->lock);
+        return rc;
+}
+
 netdev_tx_t wil_start_xmit(struct sk_buff *skb, struct net_device *ndev)
 {
         struct wil6210_priv *wil = ndev_to_wil(ndev);
@@ -1034,14 +1082,14 @@ netdev_tx_t wil_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         int rc;
 
         wil_dbg_txrx(wil, "%s()\n", __func__);
-        if (!test_bit(wil_status_fwready, &wil->status)) {
+        if (!test_bit(wil_status_fwready, wil->status)) {
                 if (!pr_once_fw) {
                         wil_err(wil, "FW not ready\n");
                         pr_once_fw = true;
                 }
                 goto drop;
         }
-        if (!test_bit(wil_status_fwconnected, &wil->status)) {
+        if (!test_bit(wil_status_fwconnected, wil->status)) {
                 wil_err(wil, "FW not connected\n");
                 goto drop;
         }
@@ -1052,15 +1100,19 @@ netdev_tx_t wil_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         pr_once_fw = false;
 
         /* find vring */
-        if (is_unicast_ether_addr(eth->h_dest))
-                vring = wil_find_tx_vring(wil, skb);
-        else
-                vring = wil_tx_bcast(wil, skb);
+        if (wil->wdev->iftype == NL80211_IFTYPE_STATION) {
+                /* in STA mode (ESS), all to same VRING */
+                vring = wil_find_tx_vring_sta(wil, skb);
+        } else { /* direct communication, find matching VRING */
+                if (is_unicast_ether_addr(eth->h_dest))
+                        vring = wil_find_tx_vring(wil, skb);
+                else
+                        vring = wil_tx_bcast(wil, skb);
+        }
         if (!vring) {
                 wil_dbg_txrx(wil, "No Tx VRING found for %pM\n", eth->h_dest);
                 goto drop;
         }
-
         /* set up vring entry */
         rc = wil_tx_vring(wil, vring, skb);
 
@@ -1087,6 +1139,22 @@ netdev_tx_t wil_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         return NET_XMIT_DROP;
 }
 
+static inline bool wil_need_txstat(struct sk_buff *skb)
+{
+        struct ethhdr *eth = (void *)skb->data;
+
+        return is_unicast_ether_addr(eth->h_dest) && skb->sk &&
+               (skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS);
+}
+
+static inline void wil_consume_skb(struct sk_buff *skb, bool acked)
+{
+        if (unlikely(wil_need_txstat(skb)))
+                skb_complete_wifi_ack(skb, acked);
+        else
+                acked ? dev_consume_skb_any(skb) : dev_kfree_skb_any(skb);
+}
+
 /**
  * Clean up transmitted skb's from the Tx VRING
  *
@@ -1147,10 +1215,10 @@ int wil_tx_complete(struct wil6210_priv *wil, int ringid)
                         trace_wil6210_tx_done(ringid, vring->swtail, dmalen,
                                               d->dma.error);
                         wil_dbg_txrx(wil,
-                                     "Tx[%3d] : %d bytes, status 0x%02x err 0x%02x\n",
-                                     vring->swtail, dmalen, d->dma.status,
-                                     d->dma.error);
-                        wil_hex_dump_txrx("TxC ", DUMP_PREFIX_NONE, 32, 4,
+                                     "TxC[%2d][%3d] : %d bytes, status 0x%02x err 0x%02x\n",
+                                     ringid, vring->swtail, dmalen,
+                                     d->dma.status, d->dma.error);
+                        wil_hex_dump_txrx("TxCD ", DUMP_PREFIX_NONE, 32, 4,
                                           (const void *)d, sizeof(*d), false);
 
                         wil_txdesc_unmap(dev, d, ctx);
@@ -1165,8 +1233,7 @@ int wil_tx_complete(struct wil6210_priv *wil, int ringid)
                                         ndev->stats.tx_errors++;
                                         stats->tx_errors++;
                                 }
-
-                                dev_kfree_skb_any(skb);
+                                wil_consume_skb(skb, d->dma.error == 0);
                         }
                         memset(ctx, 0, sizeof(*ctx));
                         /* There is no need to touch HW descriptor:
diff --git a/drivers/net/wireless/ath/wil6210/txrx.h b/drivers/net/wireless/ath/wil6210/txrx.h
index 630aeb5fa7f4..d90c8aa20c15 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.h
+++ b/drivers/net/wireless/ath/wil6210/txrx.h
@@ -20,17 +20,15 @@
 #define BUF_SW_OWNED    (1)
 #define BUF_HW_OWNED    (0)
 
-/* size of max. Tx/Rx buffers, as supported by FW */
-#define TXRX_BUF_LEN_DEFAULT (2242)
+/* default size of MAC Tx/Rx buffers */
+#define TXRX_BUF_LEN_DEFAULT (2048)
 
 /* how many bytes to reserve for rtap header? */
 #define WIL6210_RTAP_SIZE (128)
 
 /* Tx/Rx path */
 
-/*
- * Common representation of physical address in Vring
- */
+/* Common representation of physical address in Vring */
 struct vring_dma_addr {
         __le32 addr_low;
         __le16 addr_high;
@@ -49,11 +47,10 @@ static inline void wil_desc_addr_set(struct vring_dma_addr *addr,
         addr->addr_high = cpu_to_le16((u16)upper_32_bits(pa));
 }
 
-/*
- * Tx descriptor - MAC part
+/* Tx descriptor - MAC part
  * [dword 0]
  * bit  0.. 9 : lifetime_expiry_value:10
- * bit     10 : interrup_en:1
+ * bit     10 : interrupt_en:1
  * bit     11 : status_en:1
  * bit 12..13 : txss_override:2
  * bit     14 : timestamp_insertion:1
@@ -61,15 +58,12 @@ static inline void wil_desc_addr_set(struct vring_dma_addr *addr,
  * bit 16..21 : reserved0:6
  * bit 22..26 : mcs_index:5
  * bit     27 : mcs_en:1
- * bit 28..29 : reserved1:2
- * bit     30 : reserved2:1
+ * bit 28..30 : reserved1:3
  * bit     31 : sn_preserved:1
  * [dword 1]
  * bit  0.. 3 : pkt_mode:4
  * bit      4 : pkt_mode_en:1
- * bit  5.. 7 : reserved0:3
- * bit  8..13 : reserved1:6
- * bit     14 : reserved2:1
+ * bit  5..14 : reserved0:10
  * bit     15 : ack_policy_en:1
  * bit 16..19 : dst_index:4
  * bit     20 : dst_index_en:1
@@ -80,7 +74,7 @@ static inline void wil_desc_addr_set(struct vring_dma_addr *addr,
  * [dword 2]
  * bit  0.. 7 : num_of_descriptors:8
  * bit  8..17 : reserved:10
- * bit 18..19 : l2_translation_type:2
+ * bit 18..19 : l2_translation_type:2 00 - bypass, 01 - 802.3, 10 - 802.11
  * bit     20 : snap_hdr_insertion_en:1
  * bit     21 : vlan_removal_en:1
  * bit 22..31 : reserved0:10
@@ -247,6 +241,46 @@ struct vring_tx_mac {
 
 #define TX_DMA_STATUS_DU         BIT(0)
 
+/* Tx descriptor - DMA part
+ * [dword 0]
+ * bit  0.. 7 : l4_length:8 layer 4 length
+ * bit      8 : cmd_eop:1 This descriptor is the last one in the packet
+ * bit      9 : reserved
+ * bit     10 : cmd_dma_it:1 immediate interrupt
+ * bit 11..12 : SBD - Segment Buffer Details
+ *              00 - Header Segment
+ *              01 - First Data Segment
+ *              10 - Medium Data Segment
+ *              11 - Last Data Segment
+ * bit     13 : TSE - TCP Segmentation Enable
+ * bit     14 : IIC - Directs the HW to Insert IPv4 Checksum
+ * bit     15 : ITC - Directs the HW to Insert TCP/UDP Checksum
+ * bit 16..20 : QID - The target QID that the packet should be stored
+ *              in the MAC.
+ * bit     21 : PO - Pseudo header Offload:
+ *              0 - Use the pseudo header value from the TCP checksum field
+ *              1- Calculate Pseudo header Checksum
+ * bit     22 : NC - No UDP Checksum
+ * bit 23..29 : reserved
+ * bit 30..31 : L4T - Layer 4 Type: 00 - UDP , 10 - TCP , 10, 11 - Reserved
+ *              If L4Len equal 0, no L4 at all
+ * [dword 1]
+ * bit  0..31 : addr_low:32 The payload buffer low address
+ * [dword 2]
+ * bit  0..15 : addr_high:16 The payload buffer high address
+ * bit 16..23 : ip_length:8 The IP header length for the TX IP checksum
+ *              offload feature
+ * bit 24..30 : mac_length:7
+ * bit     31 : ip_version:1 1 - IPv4, 0 - IPv6
+ * [dword 3]
+ *  [byte 12] error
+ * bit  0   2 : mac_status:3
+ * bit  3   7 : reserved:5
+ *  [byte 13] status
+ * bit      0 : DU:1 Descriptor Used
+ * bit  1   7 : reserved:7
+ *  [word 7] length
+ */
 struct vring_tx_dma {
         u32 d0;
         struct vring_dma_addr addr;
@@ -257,45 +291,45 @@ struct vring_tx_dma {
         __le16 length;
 } __packed;
 
-/*
- * Rx descriptor - MAC part
+/* Rx descriptor - MAC part
  * [dword 0]
  * bit  0.. 3 : tid:4 The QoS (b3-0) TID Field
- * bit  4.. 6 : connection_id:3 :The Source index that  was found during
- *  Parsing the TA.  This field is used to  define the source of the packet
+ * bit  4.. 6 : cid:3 The Source index that  was found during parsing the TA.
+ *              This field is used to define the source of the packet
  * bit      7 : reserved:1
- * bit  8.. 9 : mac_id:2 : The MAC virtual  Ring number (always zero)
- * bit 10..11 : frame_type:2 : The FC Control  (b3-2) -  MPDU Type
- *              (management, data, control  and extension)
- * bit 12..15 : frame_subtype:4 : The FC Control  (b7-4) -  Frame Subtype
+ * bit  8.. 9 : mid:2 The MAC virtual number
+ * bit 10..11 : frame_type:2 : The FC (b3-2) - MPDU Type
+ *              (management, data, control and extension)
+ * bit 12..15 : frame_subtype:4 : The FC (b7-4) - Frame Subtype
  * bit 16..27 : seq_number:12 The received Sequence number field
  * bit 28..31 : extended:4 extended subtype
  * [dword 1]
  * bit  0.. 3 : reserved
  * bit  4.. 5 : key_id:2
  * bit      6 : decrypt_bypass:1
- * bit      7 : security:1
- * bit  8.. 9 : ds_bits:2
- * bit     10 : a_msdu_present:1  from qos header
- * bit     11 : a_msdu_type:1  from qos header
+ * bit      7 : security:1 FC (b14)
+ * bit  8.. 9 : ds_bits:2 FC (b9-8)
+ * bit     10 : a_msdu_present:1  QoS (b7)
+ * bit     11 : a_msdu_type:1  QoS (b8)
  * bit     12 : a_mpdu:1  part of AMPDU aggregation
  * bit     13 : broadcast:1
  * bit     14 : mutlicast:1
  * bit     15 : reserved:1
- * bit 16..20 : rx_mac_qid:5   The Queue Identifier that the packet
- *                             is received from
+ * bit 16..20 : rx_mac_qid:5 The Queue Identifier that the packet
+ *              is received from
  * bit 21..24 : mcs:4
- * bit 25..28 : mic_icr:4
+ * bit 25..28 : mic_icr:4 this signal tells the DMA to assert an interrupt
+ *              after it writes the packet
  * bit 29..31 : reserved:3
  * [dword 2]
  * bit  0.. 2 : time_slot:3 The timeslot that the MPDU is received
- * bit      3 : fc_protocol_ver:1 The FC Control  (b0) - Protocol  Version
- * bit      4 : fc_order:1 The FC Control (b15) -Order
- * bit  5.. 7 : qos_ack_policy:3  The QoS (b6-5) ack policy Field
+ * bit  3.. 4 : fc_protocol_ver:1 The FC (b1-0) - Protocol Version
+ * bit      5 : fc_order:1 The FC Control (b15) -Order
+ * bit  6.. 7 : qos_ack_policy:2 The QoS (b6-5) ack policy Field
  * bit      8 : esop:1 The QoS (b4) ESOP field
- * bit      9 : qos_rdg_more_ppdu:1 The QoS (b9) RDG  field
- * bit 10..14 : qos_reserved:5 The QoS (b14-10) Reserved  field
- * bit     15 : qos_ac_constraint:1
+ * bit      9 : qos_rdg_more_ppdu:1 The QoS (b9) RDG field
+ * bit 10..14 : qos_reserved:5 The QoS (b14-10) Reserved field
+ * bit     15 : qos_ac_constraint:1 QoS (b15)
  * bit 16..31 : pn_15_0:16 low 2 bytes of PN
  * [dword 3]
  * bit  0..31 : pn_47_16:32 high 4 bytes of PN
@@ -308,35 +342,46 @@ struct vring_rx_mac {
         u32 pn_47_16;
 } __packed;
 
-/*
- * Rx descriptor - DMA part
+/* Rx descriptor - DMA part
  * [dword 0]
- * bit  0.. 7 : l4_length:8 layer 4 length
- * bit  8.. 9 : reserved:2
- * bit     10 : cmd_dma_it:1
+ * bit  0.. 7 : l4_length:8 layer 4 length. The field is only valid if
+ *              L4I bit is set
+ * bit      8 : cmd_eop:1 set to 1
+ * bit      9 : cmd_rt:1 set to 1
+ * bit     10 : cmd_dma_it:1 immediate interrupt
  * bit 11..15 : reserved:5
- * bit 16..29 : phy_info_length:14
+ * bit 16..29 : phy_info_length:14 It is valid when the PII is set.
+ *              When the FFM bit is set bits 29-27 are used for for
+ *              Flex Filter Match. Matching Index to one of the L2
+ *              EtherType Flex Filter
  * bit 30..31 : l4_type:2 valid if the L4I bit is set in the status field
+ *              00 - UDP, 01 - TCP, 10, 11 - reserved
  * [dword 1]
  * bit  0..31 : addr_low:32 The payload buffer low address
  * [dword 2]
  * bit  0..15 : addr_high:16 The payload buffer high address
- * bit 16..23 : ip_length:8
+ * bit 16..23 : ip_length:8 The filed is valid only if the L3I bit is set
  * bit 24..30 : mac_length:7
- * bit     31 : ip_version:1
+ * bit     31 : ip_version:1 1 - IPv4, 0 - IPv6
  * [dword 3]
  *  [byte 12] error
+ * bit      0 : FCS:1
+ * bit      1 : MIC:1
+ * bit      2 : Key miss:1
+ * bit      3 : Replay:1
+ * bit      4 : L3:1 IPv4 checksum
+ * bit      5 : L4:1 TCP/UDP checksum
+ * bit  6   7 : reserved:2
  *  [byte 13] status
- * bit      0 : du:1
- * bit      1 : eop:1
+ * bit      0 : DU:1 Descriptor Used
+ * bit      1 : EOP:1 The descriptor indicates the End of Packet
  * bit      2 : error:1
- * bit      3 : mi:1
- * bit      4 : l3_identified:1
- * bit      5 : l4_identified:1
- * bit      6 : phy_info_included:1
- * bit      7 : reserved:1
+ * bit      3 : MI:1 MAC Interrupt is asserted (according to parser decision)
+ * bit      4 : L3I:1 L3 identified and checksum calculated
+ * bit      5 : L4I:1 L4 identified and checksum calculated
+ * bit      6 : PII:1 PHY Info Included in the packet
+ * bit      7 : FFM:1 EtherType Flex Filter Match
  *  [word 7] length
- *
  */
 
 #define RX_DMA_D0_CMD_DMA_IT     BIT(10)
@@ -349,9 +394,9 @@ struct vring_rx_mac {
 #define RX_DMA_STATUS_DU         BIT(0)
 #define RX_DMA_STATUS_ERROR      BIT(2)
 
-#define RX_DMA_STATUS_L3_IDENT   BIT(4)
-#define RX_DMA_STATUS_L4_IDENT   BIT(5)
-#define RX_DMA_STATUS_PHY_INFO   BIT(6)
+#define RX_DMA_STATUS_L3I       BIT(4)
+#define RX_DMA_STATUS_L4I       BIT(5)
+#define RX_DMA_STATUS_PHY_INFO  BIT(6)
 
 struct vring_rx_dma {
         u32 d0;
@@ -423,6 +468,11 @@ static inline int wil_rxdesc_mcs(struct vring_rx_desc *d)
         return WIL_GET_BITS(d->mac.d1, 21, 24);
 }
 
+static inline int wil_rxdesc_mcast(struct vring_rx_desc *d)
+{
+        return WIL_GET_BITS(d->mac.d1, 13, 14);
+}
+
 static inline int wil_rxdesc_phy_length(struct vring_rx_desc *d)
 {
         return WIL_GET_BITS(d->dma.d0, 16, 29);
diff --git a/drivers/net/wireless/ath/wil6210/wil6210.h b/drivers/net/wireless/ath/wil6210/wil6210.h
index c6ec5b99ac7d..94611568fc9a 100644
--- a/drivers/net/wireless/ath/wil6210/wil6210.h
+++ b/drivers/net/wireless/ath/wil6210/wil6210.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 Qualcomm Atheros, Inc.
+ * Copyright (c) 2012-2015 Qualcomm Atheros, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -25,19 +25,14 @@
 
 extern bool no_fw_recovery;
 extern unsigned int mtu_max;
+extern unsigned short rx_ring_overflow_thrsh;
+extern int agg_wsize;
 
 #define WIL_NAME "wil6210"
 #define WIL_FW_NAME "wil6210.fw"
 
 #define WIL_MAX_BUS_REQUEST_KBPS 800000 /* ~6.1Gbps */
 
-struct wil_board {
-        int board;
-#define WIL_BOARD_MARLON        (1)
-#define WIL_BOARD_SPARROW       (2)
-        const char * const name;
-};
-
 /**
  * extract bits [@b0:@b1] (inclusive) from the value @x
  * it should be @b0 <= @b1, or result is incorrect
@@ -49,21 +44,50 @@ static inline u32 WIL_GET_BITS(u32 x, int b0, int b1)
 
 #define WIL6210_MEM_SIZE (2*1024*1024UL)
 
-#define WIL_RX_RING_SIZE_ORDER_DEFAULT  (9)
-#define WIL_TX_RING_SIZE_ORDER_DEFAULT  (9)
+#define WIL_TX_Q_LEN_DEFAULT            (4000)
+#define WIL_RX_RING_SIZE_ORDER_DEFAULT  (10)
+#define WIL_TX_RING_SIZE_ORDER_DEFAULT  (10)
 /* limit ring size in range [32..32k] */
 #define WIL_RING_SIZE_ORDER_MIN (5)
 #define WIL_RING_SIZE_ORDER_MAX (15)
 #define WIL6210_MAX_TX_RINGS    (24) /* HW limit */
 #define WIL6210_MAX_CID         (8) /* HW limit */
 #define WIL6210_NAPI_BUDGET     (16) /* arbitrary */
+#define WIL_MAX_AMPDU_SIZE      (64 * 1024) /* FW/HW limit */
+#define WIL_MAX_AGG_WSIZE       (32) /* FW/HW limit */
+/* Hardware offload block adds the following:
+ * 26 bytes - 3-address QoS data header
+ *  8 bytes - IV + EIV (for GCMP)
+ *  8 bytes - SNAP
+ * 16 bytes - MIC (for GCMP)
+ *  4 bytes - CRC
+ */
+#define WIL_MAX_MPDU_OVERHEAD   (62)
+
+/* Calculate MAC buffer size for the firmware. It includes all overhead,
+ * as it will go over the air, and need to be 8 byte aligned
+ */
+static inline u32 wil_mtu2macbuf(u32 mtu)
+{
+        return ALIGN(mtu + WIL_MAX_MPDU_OVERHEAD, 8);
+}
+
+/* MTU for Ethernet need to take into account 8-byte SNAP header
+ * to be added when encapsulating Ethernet frame into 802.11
+ */
+#define WIL_MAX_ETH_MTU         (IEEE80211_MAX_DATA_LEN_DMG - 8)
 /* Max supported by wil6210 value for interrupt threshold is 5sec. */
 #define WIL6210_ITR_TRSH_MAX (5000000)
-#define WIL6210_ITR_TRSH_DEFAULT        (300) /* usec */
+#define WIL6210_ITR_TX_INTERFRAME_TIMEOUT_DEFAULT (13) /* usec */
+#define WIL6210_ITR_RX_INTERFRAME_TIMEOUT_DEFAULT (13) /* usec */
+#define WIL6210_ITR_TX_MAX_BURST_DURATION_DEFAULT (500) /* usec */
+#define WIL6210_ITR_RX_MAX_BURST_DURATION_DEFAULT (500) /* usec */
 #define WIL6210_FW_RECOVERY_RETRIES     (5) /* try to recover this many times */
 #define WIL6210_FW_RECOVERY_TO  msecs_to_jiffies(5000)
 #define WIL6210_SCAN_TO         msecs_to_jiffies(10000)
-
+#define WIL6210_RX_HIGH_TRSH_INIT               (0)
+#define WIL6210_RX_HIGH_TRSH_DEFAULT \
+                                (1 << (WIL_RX_RING_SIZE_ORDER_DEFAULT - 3))
 /* Hardware definitions begin */
 
 /*
@@ -135,7 +159,7 @@ struct RGF_ICR {
         #define BIT_DMA_EP_MISC_ICR_TX_NO_ACT   BIT(1)
         #define BIT_DMA_EP_MISC_ICR_FW_INT(n)   BIT(28+n) /* n = [0..3] */
 
-/* Interrupt moderation control */
+/* Legacy interrupt moderation control (before Sparrow v2)*/
 #define RGF_DMA_ITR_CNT_TRSH            (0x881c5c)
 #define RGF_DMA_ITR_CNT_DATA            (0x881c60)
 #define RGF_DMA_ITR_CNT_CRL             (0x881c64)
@@ -145,6 +169,46 @@ struct RGF_ICR {
         #define BIT_DMA_ITR_CNT_CRL_CLR         BIT(3)
         #define BIT_DMA_ITR_CNT_CRL_REACH_TRSH  BIT(4)
 
+/* New (sparrow v2+) interrupt moderation control */
+#define RGF_DMA_ITR_TX_DESQ_NO_MOD              (0x881d40)
+#define RGF_DMA_ITR_TX_CNT_TRSH                 (0x881d34)
+#define RGF_DMA_ITR_TX_CNT_DATA                 (0x881d38)
+#define RGF_DMA_ITR_TX_CNT_CTL                  (0x881d3c)
+        #define BIT_DMA_ITR_TX_CNT_CTL_EN               BIT(0)
+        #define BIT_DMA_ITR_TX_CNT_CTL_EXT_TIC_SEL      BIT(1)
+        #define BIT_DMA_ITR_TX_CNT_CTL_FOREVER          BIT(2)
+        #define BIT_DMA_ITR_TX_CNT_CTL_CLR              BIT(3)
+        #define BIT_DMA_ITR_TX_CNT_CTL_REACHED_TRESH    BIT(4)
+        #define BIT_DMA_ITR_TX_CNT_CTL_CROSS_EN         BIT(5)
+        #define BIT_DMA_ITR_TX_CNT_CTL_FREE_RUNNIG      BIT(6)
+#define RGF_DMA_ITR_TX_IDL_CNT_TRSH                     (0x881d60)
+#define RGF_DMA_ITR_TX_IDL_CNT_DATA                     (0x881d64)
+#define RGF_DMA_ITR_TX_IDL_CNT_CTL                      (0x881d68)
+        #define BIT_DMA_ITR_TX_IDL_CNT_CTL_EN                   BIT(0)
+        #define BIT_DMA_ITR_TX_IDL_CNT_CTL_EXT_TIC_SEL          BIT(1)
+        #define BIT_DMA_ITR_TX_IDL_CNT_CTL_FOREVER              BIT(2)
+        #define BIT_DMA_ITR_TX_IDL_CNT_CTL_CLR                  BIT(3)
+        #define BIT_DMA_ITR_TX_IDL_CNT_CTL_REACHED_TRESH        BIT(4)
+#define RGF_DMA_ITR_RX_DESQ_NO_MOD              (0x881d50)
+#define RGF_DMA_ITR_RX_CNT_TRSH                 (0x881d44)
+#define RGF_DMA_ITR_RX_CNT_DATA                 (0x881d48)
+#define RGF_DMA_ITR_RX_CNT_CTL                  (0x881d4c)
+        #define BIT_DMA_ITR_RX_CNT_CTL_EN               BIT(0)
+        #define BIT_DMA_ITR_RX_CNT_CTL_EXT_TIC_SEL      BIT(1)
+        #define BIT_DMA_ITR_RX_CNT_CTL_FOREVER          BIT(2)
+        #define BIT_DMA_ITR_RX_CNT_CTL_CLR              BIT(3)
+        #define BIT_DMA_ITR_RX_CNT_CTL_REACHED_TRESH    BIT(4)
+        #define BIT_DMA_ITR_RX_CNT_CTL_CROSS_EN         BIT(5)
+        #define BIT_DMA_ITR_RX_CNT_CTL_FREE_RUNNIG      BIT(6)
+#define RGF_DMA_ITR_RX_IDL_CNT_TRSH                     (0x881d54)
+#define RGF_DMA_ITR_RX_IDL_CNT_DATA                     (0x881d58)
+#define RGF_DMA_ITR_RX_IDL_CNT_CTL                      (0x881d5c)
+        #define BIT_DMA_ITR_RX_IDL_CNT_CTL_EN                   BIT(0)
+        #define BIT_DMA_ITR_RX_IDL_CNT_CTL_EXT_TIC_SEL          BIT(1)
+        #define BIT_DMA_ITR_RX_IDL_CNT_CTL_FOREVER              BIT(2)
+        #define BIT_DMA_ITR_RX_IDL_CNT_CTL_CLR                  BIT(3)
+        #define BIT_DMA_ITR_RX_IDL_CNT_CTL_REACHED_TRESH        BIT(4)
+
 #define RGF_DMA_PSEUDO_CAUSE            (0x881c68)
 #define RGF_DMA_PSEUDO_CAUSE_MASK_SW    (0x881c6c)
 #define RGF_DMA_PSEUDO_CAUSE_MASK_FW    (0x881c70)
@@ -164,6 +228,20 @@ struct RGF_ICR {
 #define RGF_CAF_PLL_LOCK_STATUS         (0x88afec)
         #define BIT_CAF_OSC_DIG_XTAL_STABLE     BIT(0)
 
+#define RGF_USER_JTAG_DEV_ID    (0x880b34) /* device ID */
+        #define JTAG_DEV_ID_MARLON_B0   (0x0612072f)
+        #define JTAG_DEV_ID_SPARROW_A0  (0x0632072f)
+        #define JTAG_DEV_ID_SPARROW_A1  (0x1632072f)
+        #define JTAG_DEV_ID_SPARROW_B0  (0x2632072f)
+
+enum {
+        HW_VER_UNKNOWN,
+        HW_VER_MARLON_B0,  /* JTAG_DEV_ID_MARLON_B0  */
+        HW_VER_SPARROW_A0, /* JTAG_DEV_ID_SPARROW_A0 */
+        HW_VER_SPARROW_A1, /* JTAG_DEV_ID_SPARROW_A1 */
+        HW_VER_SPARROW_B0, /* JTAG_DEV_ID_SPARROW_B0 */
+};
+
 /* popular locations */
 #define HOST_MBOX   HOSTADDR(RGF_USER_USER_SCRATCH_PAD)
 #define HOST_SW_INT (HOSTADDR(RGF_USER_USER_ICR) + \
@@ -303,6 +381,11 @@ struct vring {
 struct vring_tx_data {
         int enabled;
         cycles_t idle, last_idle, begin;
+        u8 agg_wsize; /* agreed aggregation window, 0 - no agg */
+        u16 agg_timeout;
+        u8 agg_amsdu;
+        bool addba_in_progress; /* if set, agg_xxx is for request in progress */
+        spinlock_t lock;
 };
 
 enum { /* for wil6210_priv.status */
@@ -313,6 +396,7 @@ enum { /* for wil6210_priv.status */
         wil_status_reset_done,
         wil_status_irqen, /* FIXME: interrupts enabled - for debug */
         wil_status_napi_en, /* NAPI enabled protected by wil->mutex */
+        wil_status_last /* keep last */
 };
 
 struct pci_dev;
@@ -397,15 +481,46 @@ enum {
         fw_recovery_running = 2,
 };
 
+enum {
+        hw_capability_reset_v2 = 0,
+        hw_capability_advanced_itr_moderation = 1,
+        hw_capability_last
+};
+
+struct wil_back_rx {
+        struct list_head list;
+        /* request params, converted to CPU byte order - what we asked for */
+        u8 cidxtid;
+        u8 dialog_token;
+        u16 ba_param_set;
+        u16 ba_timeout;
+        u16 ba_seq_ctrl;
+};
+
+struct wil_back_tx {
+        struct list_head list;
+        /* request params, converted to CPU byte order - what we asked for */
+        u8 ringid;
+        u8 agg_wsize;
+        u16 agg_timeout;
+};
+
+struct wil_probe_client_req {
+        struct list_head list;
+        u64 cookie;
+        u8 cid;
+};
+
 struct wil6210_priv {
         struct pci_dev *pdev;
         int n_msi;
         struct wireless_dev *wdev;
         void __iomem *csr;
-        ulong status;
+        DECLARE_BITMAP(status, wil_status_last);
         u32 fw_version;
         u32 hw_version;
-        struct wil_board *board;
+        const char *hw_name;
+        DECLARE_BITMAP(hw_capabilities, hw_capability_last);
         u8 n_mids; /* number of additional MIDs as reported by FW */
         u32 recovery_count; /* num of FW recovery attempts in a short time */
         u32 recovery_state; /* FW recovery state machine */
@@ -415,7 +530,11 @@ struct wil6210_priv {
         u32 monitor_flags;
         u32 secure_pcp; /* create secure PCP? */
         int sinfo_gen;
-        u32 itr_trsh;
+        /* interrupt moderation */
+        u32 tx_max_burst_duration;
+        u32 tx_interframe_timeout;
+        u32 rx_max_burst_duration;
+        u32 rx_interframe_timeout;
         /* cached ISR registers */
         u32 isr_misc;
         /* mailbox related */
@@ -429,7 +548,7 @@ struct wil6210_priv {
         u16 reply_size;
         struct workqueue_struct *wmi_wq; /* for deferred calls */
         struct work_struct wmi_event_worker;
-        struct workqueue_struct *wmi_wq_conn; /* for connect worker */
+        struct workqueue_struct *wq_service;
         struct work_struct connect_worker;
         struct work_struct disconnect_worker;
         struct work_struct fw_error_worker;     /* for FW error recovery */
@@ -445,6 +564,17 @@ struct wil6210_priv {
         spinlock_t wmi_ev_lock;
         struct napi_struct napi_rx;
         struct napi_struct napi_tx;
+        /* BACK */
+        struct list_head back_rx_pending;
+        struct mutex back_rx_mutex; /* protect @back_rx_pending */
+        struct work_struct back_rx_worker;
+        struct list_head back_tx_pending;
+        struct mutex back_tx_mutex; /* protect @back_tx_pending */
+        struct work_struct back_tx_worker;
+        /* keep alive */
+        struct list_head probe_client_pending;
+        struct mutex probe_client_mutex; /* protect @probe_client_pending */
+        struct work_struct probe_client_worker;
         /* DMA related */
         struct vring vring_rx;
         struct vring vring_tx[WIL6210_MAX_TX_RINGS];
@@ -529,11 +659,8 @@ void wil_if_remove(struct wil6210_priv *wil);
 int wil_priv_init(struct wil6210_priv *wil);
 void wil_priv_deinit(struct wil6210_priv *wil);
 int wil_reset(struct wil6210_priv *wil);
-void wil_set_itr_trsh(struct wil6210_priv *wil);
 void wil_fw_error_recovery(struct wil6210_priv *wil);
 void wil_set_recovery_state(struct wil6210_priv *wil, int state);
-void wil_link_on(struct wil6210_priv *wil);
-void wil_link_off(struct wil6210_priv *wil);
 int wil_up(struct wil6210_priv *wil);
 int __wil_up(struct wil6210_priv *wil);
 int wil_down(struct wil6210_priv *wil);
@@ -567,12 +694,26 @@ int wmi_p2p_cfg(struct wil6210_priv *wil, int channel);
 int wmi_rxon(struct wil6210_priv *wil, bool on);
 int wmi_get_temperature(struct wil6210_priv *wil, u32 *t_m, u32 *t_r);
 int wmi_disconnect_sta(struct wil6210_priv *wil, const u8 *mac, u16 reason);
+int wmi_addba(struct wil6210_priv *wil, u8 ringid, u8 size, u16 timeout);
+int wmi_delba_tx(struct wil6210_priv *wil, u8 ringid, u16 reason);
+int wmi_delba_rx(struct wil6210_priv *wil, u8 cidxtid, u16 reason);
+int wmi_addba_rx_resp(struct wil6210_priv *wil, u8 cid, u8 tid, u8 token,
+                      u16 status, bool amsdu, u16 agg_wsize, u16 timeout);
+int wil_addba_rx_request(struct wil6210_priv *wil, u8 cidxtid,
+                         u8 dialog_token, __le16 ba_param_set,
+                         __le16 ba_timeout, __le16 ba_seq_ctrl);
+void wil_back_rx_worker(struct work_struct *work);
+void wil_back_rx_flush(struct wil6210_priv *wil);
+int wil_addba_tx_request(struct wil6210_priv *wil, u8 ringid, u16 wsize);
+void wil_back_tx_worker(struct work_struct *work);
+void wil_back_tx_flush(struct wil6210_priv *wil);
 
 void wil6210_clear_irq(struct wil6210_priv *wil);
 int wil6210_init_irq(struct wil6210_priv *wil, int irq);
 void wil6210_fini_irq(struct wil6210_priv *wil, int irq);
 void wil_mask_irq(struct wil6210_priv *wil);
 void wil_unmask_irq(struct wil6210_priv *wil);
+void wil_configure_interrupt_moderation(struct wil6210_priv *wil);
 void wil_disable_irq(struct wil6210_priv *wil);
 void wil_enable_irq(struct wil6210_priv *wil);
 int wil_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
@@ -592,6 +733,8 @@ int wmi_pcp_start(struct wil6210_priv *wil, int bi, u8 wmi_nettype, u8 chan);
 int wmi_pcp_stop(struct wil6210_priv *wil);
 void wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid,
                         u16 reason_code, bool from_event);
+void wil_probe_client_flush(struct wil6210_priv *wil);
+void wil_probe_client_worker(struct work_struct *work);
 
 int wil_rx_init(struct wil6210_priv *wil, u16 size);
 void wil_rx_fini(struct wil6210_priv *wil);
diff --git a/drivers/net/wireless/ath/wil6210/wil_platform.c b/drivers/net/wireless/ath/wil6210/wil_platform.c
index 8f1d78f8a74d..976a071ba74e 100644
--- a/drivers/net/wireless/ath/wil6210/wil_platform.c
+++ b/drivers/net/wireless/ath/wil6210/wil_platform.c
@@ -17,10 +17,6 @@
 #include "linux/device.h"
 #include "wil_platform.h"
 
-#ifdef CONFIG_WIL6210_PLATFORM_MSM
-#include "wil_platform_msm.h"
-#endif
-
 /**
  * wil_platform_init() - wil6210 platform module init
  *
@@ -37,13 +33,7 @@ void *wil_platform_init(struct device *dev, struct wil_platform_ops *ops)
                 return NULL;
         }
 
-#ifdef CONFIG_WIL6210_PLATFORM_MSM
-        handle = wil_platform_msm_init(dev, ops);
-        if (handle)
-                return handle;
-#endif
-
-        /* other platform specific init functions should be called here */
+        /* platform specific init functions should be called here */
 
         return handle;
 }
diff --git a/drivers/net/wireless/ath/wil6210/wil_platform_msm.c b/drivers/net/wireless/ath/wil6210/wil_platform_msm.c
deleted file mode 100644
index b354a743240d..000000000000
--- a/drivers/net/wireless/ath/wil6210/wil_platform_msm.c
+++ /dev/null
@@ -1,257 +0,0 @@
-/*
- * Copyright (c) 2014 Qualcomm Atheros, Inc.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#include <linux/of.h>
-#include <linux/slab.h>
-#include <linux/msm-bus.h>
-
-#include "wil_platform.h"
-#include "wil_platform_msm.h"
-
-/**
- * struct wil_platform_msm - wil6210 msm platform module info
- *
- * @dev: device object
- * @msm_bus_handle: handle for using msm_bus API
- * @pdata: bus scale info retrieved from DT
- */
-struct wil_platform_msm {
-        struct device *dev;
-        uint32_t msm_bus_handle;
-        struct msm_bus_scale_pdata *pdata;
-};
-
-#define KBTOB(a) (a * 1000ULL)
-
-/**
- * wil_platform_get_pdata() - Generate bus client data from device tree
- * provided by clients.
- *
- * dev: device object
- * of_node: Device tree node to extract information from
- *
- * The function returns a valid pointer to the allocated bus-scale-pdata
- * if the vectors were correctly read from the client's device node.
- * Any error in reading or parsing the device node will return NULL
- * to the caller.
- */
-static struct msm_bus_scale_pdata *wil_platform_get_pdata(
-                struct device *dev,
-                struct device_node *of_node)
-{
-        struct msm_bus_scale_pdata *pdata;
-        struct msm_bus_paths *usecase;
-        int i, j, ret, len;
-        unsigned int num_usecases, num_paths, mem_size;
-        const uint32_t *vec_arr;
-        struct msm_bus_vectors *vectors;
-
-        /* first read num_usecases and num_paths so we can calculate
-         * amount of memory to allocate
-         */
-        ret = of_property_read_u32(of_node, "qcom,msm-bus,num-cases",
-                                   &num_usecases);
-        if (ret) {
-                dev_err(dev, "Error: num-usecases not found\n");
-                return NULL;
-        }
-
-        ret = of_property_read_u32(of_node, "qcom,msm-bus,num-paths",
-                                   &num_paths);
-        if (ret) {
-                dev_err(dev, "Error: num_paths not found\n");
-                return NULL;
-        }
-
-        /* pdata memory layout:
-         *   msm_bus_scale_pdata
-         *   msm_bus_paths[num_usecases]
-         *   msm_bus_vectors[num_usecases][num_paths]
-         */
-        mem_size = sizeof(struct msm_bus_scale_pdata) +
-                   sizeof(struct msm_bus_paths) * num_usecases +
-                   sizeof(struct msm_bus_vectors) * num_usecases * num_paths;
-
-        pdata = kzalloc(mem_size, GFP_KERNEL);
-        if (!pdata)
-                return NULL;
-
-        ret = of_property_read_string(of_node, "qcom,msm-bus,name",
-                                      &pdata->name);
-        if (ret) {
-                dev_err(dev, "Error: Client name not found\n");
-                goto err;
-        }
-
-        if (of_property_read_bool(of_node, "qcom,msm-bus,active-only")) {
-                pdata->active_only = 1;
-        } else {
-                dev_info(dev, "active_only flag absent.\n");
-                dev_info(dev, "Using dual context by default\n");
-        }
-
-        pdata->num_usecases = num_usecases;
-        pdata->usecase = (struct msm_bus_paths *)(pdata + 1);
-
-        vec_arr = of_get_property(of_node, "qcom,msm-bus,vectors-KBps", &len);
-        if (vec_arr == NULL) {
-                dev_err(dev, "Error: Vector array not found\n");
-                goto err;
-        }
-
-        if (len != num_usecases * num_paths * sizeof(uint32_t) * 4) {
-                dev_err(dev, "Error: Length-error on getting vectors\n");
-                goto err;
-        }
-
-        vectors = (struct msm_bus_vectors *)(pdata->usecase + num_usecases);
-        for (i = 0; i < num_usecases; i++) {
-                usecase = &pdata->usecase[i];
-                usecase->num_paths = num_paths;
-                usecase->vectors = &vectors[i];
-
-                for (j = 0; j < num_paths; j++) {
-                        int index = ((i * num_paths) + j) * 4;
-
-                        usecase->vectors[j].src = be32_to_cpu(vec_arr[index]);
-                        usecase->vectors[j].dst =
-                                be32_to_cpu(vec_arr[index + 1]);
-                        usecase->vectors[j].ab = (uint64_t)
-                                KBTOB(be32_to_cpu(vec_arr[index + 2]));
-                        usecase->vectors[j].ib = (uint64_t)
-                                KBTOB(be32_to_cpu(vec_arr[index + 3]));
-                }
-        }
-
-        return pdata;
-
-err:
-        kfree(pdata);
-
-        return NULL;
-}
-
-/* wil_platform API (callbacks) */
-
-static int wil_platform_bus_request(void *handle,
-                                    uint32_t kbps /* KBytes/Sec */)
-{
-        int rc, i;
-        struct wil_platform_msm *msm = (struct wil_platform_msm *)handle;
-        int vote = 0; /* vote 0 in case requested kbps cannot be satisfied */
-        struct msm_bus_paths *usecase;
-        uint32_t usecase_kbps;
-        uint32_t min_kbps = ~0;
-
-        /* find the lowest usecase that is bigger than requested kbps */
-        for (i = 0; i < msm->pdata->num_usecases; i++) {
-                usecase = &msm->pdata->usecase[i];
-                /* assume we have single path (vectors[0]). If we ever
-                 * have multiple paths, need to define the behavior */
-                usecase_kbps = div64_u64(usecase->vectors[0].ib, 1000);
-                if (usecase_kbps >= kbps && usecase_kbps < min_kbps) {
-                        min_kbps = usecase_kbps;
-                        vote = i;
-                }
-        }
-
-        rc = msm_bus_scale_client_update_request(msm->msm_bus_handle, vote);
-        if (rc)
-                dev_err(msm->dev, "Failed msm_bus voting. kbps=%d vote=%d, rc=%d\n",
-                        kbps, vote, rc);
-        else
-                /* TOOD: remove */
-                dev_info(msm->dev, "msm_bus_scale_client_update_request succeeded. kbps=%d vote=%d\n",
-                         kbps, vote);
-
-        return rc;
-}
-
-static void wil_platform_uninit(void *handle)
-{
-        struct wil_platform_msm *msm = (struct wil_platform_msm *)handle;
-
-        dev_info(msm->dev, "wil_platform_uninit\n");
-
-        if (msm->msm_bus_handle)
-                msm_bus_scale_unregister_client(msm->msm_bus_handle);
-
-        kfree(msm->pdata);
-        kfree(msm);
-}
-
-static int wil_platform_msm_bus_register(struct wil_platform_msm *msm,
-                                         struct device_node *node)
-{
-        msm->pdata = wil_platform_get_pdata(msm->dev, node);
-        if (!msm->pdata) {
-                dev_err(msm->dev, "Failed getting DT info\n");
-                return -EINVAL;
-        }
-
-        msm->msm_bus_handle = msm_bus_scale_register_client(msm->pdata);
-        if (!msm->msm_bus_handle) {
-                dev_err(msm->dev, "Failed msm_bus registration\n");
-                return -EINVAL;
-        }
-
-        dev_info(msm->dev, "msm_bus registration succeeded! handle 0x%x\n",
-                 msm->msm_bus_handle);
-
-        return 0;
-}
-
-/**
- * wil_platform_msm_init() - wil6210 msm platform module init
- *
- * The function must be called before all other functions in this module.
- * It returns a handle which is used with the rest of the API
- *
- */
-void *wil_platform_msm_init(struct device *dev, struct wil_platform_ops *ops)
-{
-        struct device_node *of_node;
-        struct wil_platform_msm *msm;
-        int rc;
-
-        of_node = of_find_compatible_node(NULL, NULL, "qcom,wil6210");
-        if (!of_node) {
-                /* this could mean non-msm platform */
-                dev_err(dev, "DT node not found\n");
-                return NULL;
-        }
-
-        msm = kzalloc(sizeof(*msm), GFP_KERNEL);
-        if (!msm)
-                return NULL;
-
-        msm->dev = dev;
-
-        /* register with msm_bus module for scaling requests */
-        rc = wil_platform_msm_bus_register(msm, of_node);
-        if (rc)
-                goto cleanup;
-
-        memset(ops, 0, sizeof(*ops));
-        ops->bus_request = wil_platform_bus_request;
-        ops->uninit = wil_platform_uninit;
-
-        return (void *)msm;
-
-cleanup:
-        kfree(msm);
-        return NULL;
-}
diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
index 63476c86cd0e..0f3e4334c8e3 100644
--- a/drivers/net/wireless/ath/wil6210/wmi.c
+++ b/drivers/net/wireless/ath/wil6210/wmi.c
@@ -23,10 +23,15 @@
 #include "wmi.h"
 #include "trace.h"
 
-static uint max_assoc_sta = 1;
+static uint max_assoc_sta = WIL6210_MAX_CID;
 module_param(max_assoc_sta, uint, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(max_assoc_sta, " Max number of stations associated to the AP");
 
+int agg_wsize; /* = 0; */
+module_param(agg_wsize, int, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(agg_wsize, " Window size for Tx Block Ack after connect;"
+                 " 0 - use default; < 0 - don't auto-establish");
+
 /**
  * WMI event receiving - theory of operations
  *
@@ -197,7 +202,7 @@ static int __wmi_send(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len)
 
         might_sleep();
 
-        if (!test_bit(wil_status_fwready, &wil->status)) {
+        if (!test_bit(wil_status_fwready, wil->status)) {
                 wil_err(wil, "WMI: cannot send command while FW not ready\n");
                 return -EAGAIN;
         }
@@ -300,7 +305,7 @@ static void wmi_evt_fw_ready(struct wil6210_priv *wil, int id, void *d,
         wil_dbg_wmi(wil, "WMI: got FW ready event\n");
 
         wil_set_recovery_state(wil, fw_recovery_idle);
-        set_bit(wil_status_fwready, &wil->status);
+        set_bit(wil_status_fwready, wil->status);
         /* let the reset sequence continue */
         complete(&wil->wmi_ready);
 }
@@ -438,7 +443,7 @@ static void wmi_evt_connect(struct wil6210_priv *wil, int id, void *d, int len)
 
         if ((wdev->iftype == NL80211_IFTYPE_STATION) ||
             (wdev->iftype == NL80211_IFTYPE_P2P_CLIENT)) {
-                if (!test_bit(wil_status_fwconnecting, &wil->status)) {
+                if (!test_bit(wil_status_fwconnecting, wil->status)) {
                         wil_err(wil, "Not in connecting state\n");
                         return;
                 }
@@ -457,13 +462,12 @@ static void wmi_evt_connect(struct wil6210_priv *wil, int id, void *d, int len)
                 if (assoc_req_ie) {
                         sinfo.assoc_req_ies = assoc_req_ie;
                         sinfo.assoc_req_ies_len = assoc_req_ielen;
-                        sinfo.filled |= STATION_INFO_ASSOC_REQ_IES;
                 }
 
                 cfg80211_new_sta(ndev, evt->bssid, &sinfo, GFP_KERNEL);
         }
-        clear_bit(wil_status_fwconnecting, &wil->status);
-        set_bit(wil_status_fwconnected, &wil->status);
+        clear_bit(wil_status_fwconnecting, wil->status);
+        set_bit(wil_status_fwconnected, wil->status);
 
         /* FIXME FW can transmit only ucast frames to peer */
         /* FIXME real ring_id instead of hard coded 0 */
@@ -471,7 +475,7 @@ static void wmi_evt_connect(struct wil6210_priv *wil, int id, void *d, int len)
         wil->sta[evt->cid].status = wil_sta_conn_pending;
 
         wil->pending_connect_cid = evt->cid;
-        queue_work(wil->wmi_wq_conn, &wil->connect_worker);
+        queue_work(wil->wq_service, &wil->connect_worker);
 }
 
 static void wmi_evt_disconnect(struct wil6210_priv *wil, int id,
@@ -544,9 +548,24 @@ static void wmi_evt_eapol_rx(struct wil6210_priv *wil, int id,
         }
 }
 
+static void wil_addba_tx_cid(struct wil6210_priv *wil, u8 cid, u16 wsize)
+{
+        struct vring_tx_data *t;
+        int i;
+
+        for (i = 0; i < WIL6210_MAX_TX_RINGS; i++) {
+                if (cid != wil->vring2cid_tid[i][0])
+                        continue;
+                t = &wil->vring_tx_data[i];
+                if (!t->enabled)
+                        continue;
+
+                wil_addba_tx_request(wil, i, wsize);
+        }
+}
+
 static void wmi_evt_linkup(struct wil6210_priv *wil, int id, void *d, int len)
 {
-        struct net_device *ndev = wil_to_ndev(wil);
         struct wmi_data_port_open_event *evt = d;
         u8 cid = evt->cid;
 
@@ -558,7 +577,8 @@ static void wmi_evt_linkup(struct wil6210_priv *wil, int id, void *d, int len)
         }
 
         wil->sta[cid].data_port_open = true;
-        netif_carrier_on(ndev);
+        if (agg_wsize >= 0)
+                wil_addba_tx_cid(wil, cid, agg_wsize);
 }
 
 static void wmi_evt_linkdown(struct wil6210_priv *wil, int id, void *d, int len)
@@ -583,55 +603,89 @@ static void wmi_evt_ba_status(struct wil6210_priv *wil, int id, void *d,
                               int len)
 {
         struct wmi_vring_ba_status_event *evt = d;
-        struct wil_sta_info *sta;
-        uint i, cid;
+        struct vring_tx_data *txdata;
 
-        /* TODO: use Rx BA status, not Tx one */
-
-        wil_dbg_wmi(wil, "BACK[%d] %s {%d} timeout %d\n",
+        wil_dbg_wmi(wil, "BACK[%d] %s {%d} timeout %d AMSDU%s\n",
                     evt->ringid,
                     evt->status == WMI_BA_AGREED ? "OK" : "N/A",
-                    evt->agg_wsize, __le16_to_cpu(evt->ba_timeout));
+                    evt->agg_wsize, __le16_to_cpu(evt->ba_timeout),
+                    evt->amsdu ? "+" : "-");
 
         if (evt->ringid >= WIL6210_MAX_TX_RINGS) {
                 wil_err(wil, "invalid ring id %d\n", evt->ringid);
                 return;
         }
 
-        mutex_lock(&wil->mutex);
-
-        cid = wil->vring2cid_tid[evt->ringid][0];
-        if (cid >= WIL6210_MAX_CID) {
-                wil_err(wil, "invalid CID %d for vring %d\n", cid, evt->ringid);
-                goto out;
+        if (evt->status != WMI_BA_AGREED) {
+                evt->ba_timeout = 0;
+                evt->agg_wsize = 0;
+                evt->amsdu = 0;
         }
 
-        sta = &wil->sta[cid];
-        if (sta->status == wil_sta_unused) {
-                wil_err(wil, "CID %d unused\n", cid);
-                goto out;
-        }
+        txdata = &wil->vring_tx_data[evt->ringid];
 
-        wil_dbg_wmi(wil, "BACK for CID %d %pM\n", cid, sta->addr);
-        for (i = 0; i < WIL_STA_TID_NUM; i++) {
-                struct wil_tid_ampdu_rx *r;
-                unsigned long flags;
+        txdata->agg_timeout = le16_to_cpu(evt->ba_timeout);
+        txdata->agg_wsize = evt->agg_wsize;
+        txdata->agg_amsdu = evt->amsdu;
+        txdata->addba_in_progress = false;
+}
 
-                spin_lock_irqsave(&sta->tid_rx_lock, flags);
+static void wmi_evt_addba_rx_req(struct wil6210_priv *wil, int id, void *d,
+                                 int len)
+{
+        struct wmi_rcp_addba_req_event *evt = d;
 
-                r = sta->tid_rx[i];
-                sta->tid_rx[i] = NULL;
-                wil_tid_ampdu_rx_free(wil, r);
+        wil_addba_rx_request(wil, evt->cidxtid, evt->dialog_token,
+                             evt->ba_param_set, evt->ba_timeout,
+                             evt->ba_seq_ctrl);
+}
 
-                spin_unlock_irqrestore(&sta->tid_rx_lock, flags);
+static void wmi_evt_delba(struct wil6210_priv *wil, int id, void *d, int len)
+__acquires(&sta->tid_rx_lock) __releases(&sta->tid_rx_lock)
+{
+        struct wmi_delba_event *evt = d;
+        u8 cid, tid;
+        u16 reason = __le16_to_cpu(evt->reason);
+        struct wil_sta_info *sta;
+        struct wil_tid_ampdu_rx *r;
 
-                if ((evt->status == WMI_BA_AGREED) && evt->agg_wsize)
-                        sta->tid_rx[i] = wil_tid_ampdu_rx_alloc(wil,
-                                                evt->agg_wsize, 0);
+        might_sleep();
+        parse_cidxtid(evt->cidxtid, &cid, &tid);
+        wil_dbg_wmi(wil, "DELBA CID %d TID %d from %s reason %d\n",
+                    cid, tid,
+                    evt->from_initiator ? "originator" : "recipient",
+                    reason);
+        if (!evt->from_initiator) {
+                int i;
+                /* find Tx vring it belongs to */
+                for (i = 0; i < ARRAY_SIZE(wil->vring2cid_tid); i++) {
+                        if ((wil->vring2cid_tid[i][0] == cid) &&
+                            (wil->vring2cid_tid[i][1] == tid)) {
+                                struct vring_tx_data *txdata =
+                                        &wil->vring_tx_data[i];
+
+                                wil_dbg_wmi(wil, "DELBA Tx vring %d\n", i);
+                                txdata->agg_timeout = 0;
+                                txdata->agg_wsize = 0;
+                                txdata->addba_in_progress = false;
+
+                                break; /* max. 1 matching ring */
+                        }
+                }
+                if (i >= ARRAY_SIZE(wil->vring2cid_tid))
+                        wil_err(wil, "DELBA: unable to find Tx vring\n");
+                return;
         }
 
-out:
-        mutex_unlock(&wil->mutex);
+        sta = &wil->sta[cid];
+
+        spin_lock_bh(&sta->tid_rx_lock);
+
+        r = sta->tid_rx[tid];
+        sta->tid_rx[tid] = NULL;
+        wil_tid_ampdu_rx_free(wil, r);
+
+        spin_unlock_bh(&sta->tid_rx_lock);
 }
 
 static const struct {
@@ -649,6 +703,8 @@ static const struct {
         {WMI_DATA_PORT_OPEN_EVENTID,    wmi_evt_linkup},
         {WMI_WBE_LINKDOWN_EVENTID,      wmi_evt_linkdown},
         {WMI_BA_STATUS_EVENTID,         wmi_evt_ba_status},
+        {WMI_RCP_ADDBA_REQ_EVENTID,     wmi_evt_addba_rx_req},
+        {WMI_DELBA_EVENTID,             wmi_evt_delba},
 };
 
 /*
@@ -668,7 +724,7 @@ void wmi_recv_cmd(struct wil6210_priv *wil)
         ulong flags;
         unsigned n;
 
-        if (!test_bit(wil_status_reset_done, &wil->status)) {
+        if (!test_bit(wil_status_reset_done, wil->status)) {
                 wil_err(wil, "Reset in progress. Cannot handle WMI event\n");
                 return;
         }
@@ -1025,13 +1081,14 @@ int wmi_rx_chain_add(struct wil6210_priv *wil, struct vring *vring)
         struct wmi_cfg_rx_chain_cmd cmd = {
                 .action = WMI_RX_CHAIN_ADD,
                 .rx_sw_ring = {
-                        .max_mpdu_size = cpu_to_le16(mtu_max + ETH_HLEN),
+                        .max_mpdu_size = cpu_to_le16(wil_mtu2macbuf(mtu_max)),
                         .ring_mem_base = cpu_to_le64(vring->pa),
                         .ring_size = cpu_to_le16(vring->size),
                 },
                 .mid = 0, /* TODO - what is it? */
                 .decap_trans_type = WMI_DECAP_TYPE_802_3,
                 .reorder_type = WMI_RX_SW_REORDER,
+                .host_thrsh = cpu_to_le16(rx_ring_overflow_thrsh),
         };
         struct {
                 struct wil6210_mbox_hdr_wmi wmi;
@@ -1074,12 +1131,13 @@ int wmi_rx_chain_add(struct wil6210_priv *wil, struct vring *vring)
         return rc;
 }
 
-int wmi_get_temperature(struct wil6210_priv *wil, u32 *t_m, u32 *t_r)
+int wmi_get_temperature(struct wil6210_priv *wil, u32 *t_bb, u32 *t_rf)
 {
         int rc;
         struct wmi_temp_sense_cmd cmd = {
-                .measure_marlon_m_en = cpu_to_le32(!!t_m),
-                .measure_marlon_r_en = cpu_to_le32(!!t_r),
+                .measure_baseband_en = cpu_to_le32(!!t_bb),
+                .measure_rf_en = cpu_to_le32(!!t_rf),
+                .measure_mode = cpu_to_le32(TEMPERATURE_MEASURE_NOW),
         };
         struct {
                 struct wil6210_mbox_hdr_wmi wmi;
@@ -1091,10 +1149,10 @@ int wmi_get_temperature(struct wil6210_priv *wil, u32 *t_m, u32 *t_r)
         if (rc)
                 return rc;
 
-        if (t_m)
-                *t_m = le32_to_cpu(reply.evt.marlon_m_t1000);
-        if (t_r)
-                *t_r = le32_to_cpu(reply.evt.marlon_r_t1000);
+        if (t_bb)
+                *t_bb = le32_to_cpu(reply.evt.baseband_t1000);
+        if (t_rf)
+                *t_rf = le32_to_cpu(reply.evt.rf_t1000);
 
         return 0;
 }
@@ -1111,6 +1169,87 @@ int wmi_disconnect_sta(struct wil6210_priv *wil, const u8 *mac, u16 reason)
         return wmi_send(wil, WMI_DISCONNECT_STA_CMDID, &cmd, sizeof(cmd));
 }
 
+int wmi_addba(struct wil6210_priv *wil, u8 ringid, u8 size, u16 timeout)
+{
+        struct wmi_vring_ba_en_cmd cmd = {
+                .ringid = ringid,
+                .agg_max_wsize = size,
+                .ba_timeout = cpu_to_le16(timeout),
+                .amsdu = 0,
+        };
+
+        wil_dbg_wmi(wil, "%s(ring %d size %d timeout %d)\n", __func__,
+                    ringid, size, timeout);
+
+        return wmi_send(wil, WMI_VRING_BA_EN_CMDID, &cmd, sizeof(cmd));
+}
+
+int wmi_delba_tx(struct wil6210_priv *wil, u8 ringid, u16 reason)
+{
+        struct wmi_vring_ba_dis_cmd cmd = {
+                .ringid = ringid,
+                .reason = cpu_to_le16(reason),
+        };
+
+        wil_dbg_wmi(wil, "%s(ring %d reason %d)\n", __func__,
+                    ringid, reason);
+
+        return wmi_send(wil, WMI_VRING_BA_DIS_CMDID, &cmd, sizeof(cmd));
+}
+
+int wmi_delba_rx(struct wil6210_priv *wil, u8 cidxtid, u16 reason)
+{
+        struct wmi_rcp_delba_cmd cmd = {
+                .cidxtid = cidxtid,
+                .reason = cpu_to_le16(reason),
+        };
+
+        wil_dbg_wmi(wil, "%s(CID %d TID %d reason %d)\n", __func__,
+                    cidxtid & 0xf, (cidxtid >> 4) & 0xf, reason);
+
+        return wmi_send(wil, WMI_RCP_DELBA_CMDID, &cmd, sizeof(cmd));
+}
+
+int wmi_addba_rx_resp(struct wil6210_priv *wil, u8 cid, u8 tid, u8 token,
+                      u16 status, bool amsdu, u16 agg_wsize, u16 timeout)
+{
+        int rc;
+        struct wmi_rcp_addba_resp_cmd cmd = {
+                .cidxtid = mk_cidxtid(cid, tid),
+                .dialog_token = token,
+                .status_code = cpu_to_le16(status),
+                /* bit 0: A-MSDU supported
+                 * bit 1: policy (should be 0 for us)
+                 * bits 2..5: TID
+                 * bits 6..15: buffer size
+                 */
+                .ba_param_set = cpu_to_le16((amsdu ? 1 : 0) | (tid << 2) |
+                                            (agg_wsize << 6)),
+                .ba_timeout = cpu_to_le16(timeout),
+        };
+        struct {
+                struct wil6210_mbox_hdr_wmi wmi;
+                struct wmi_rcp_addba_resp_sent_event evt;
+        } __packed reply;
+
+        wil_dbg_wmi(wil,
+                    "ADDBA response for CID %d TID %d size %d timeout %d status %d AMSDU%s\n",
+                    cid, tid, agg_wsize, timeout, status, amsdu ? "+" : "-");
+
+        rc = wmi_call(wil, WMI_RCP_ADDBA_RESP_CMDID, &cmd, sizeof(cmd),
+                      WMI_ADDBA_RESP_SENT_EVENTID, &reply, sizeof(reply), 100);
+        if (rc)
+                return rc;
+
+        if (reply.evt.status) {
+                wil_err(wil, "ADDBA response failed with status %d\n",
+                        le16_to_cpu(reply.evt.status));
+                rc = -EINVAL;
+        }
+
+        return rc;
+}
+
 void wmi_event_flush(struct wil6210_priv *wil)
 {
         struct pending_wmi_event *evt, *t;
diff --git a/drivers/net/wireless/ath/wil6210/wmi.h b/drivers/net/wireless/ath/wil6210/wmi.h
index 27b97432d1c2..8a4af613e191 100644
--- a/drivers/net/wireless/ath/wil6210/wmi.h
+++ b/drivers/net/wireless/ath/wil6210/wmi.h
@@ -29,8 +29,10 @@
 
 /* General */
 #define WILOCITY_MAX_ASSOC_STA (8)
+#define WILOCITY_DEFAULT_ASSOC_STA (1)
 #define WMI_MAC_LEN             (6)
 #define WMI_PROX_RANGE_NUM      (3)
+#define WMI_MAX_LOSS_DMG_BEACONS        (32)
 
 /* List of Commands */
 enum wmi_command_id {
@@ -48,7 +50,7 @@ enum wmi_command_id {
         WMI_SET_WSC_STATUS_CMDID        = 0x0041,
         WMI_PXMT_RANGE_CFG_CMDID        = 0x0042,
         WMI_PXMT_SNR2_RANGE_CFG_CMDID   = 0x0043,
-        WMI_FAST_MEM_ACC_MODE_CMDID     = 0x0300,
+/*      WMI_FAST_MEM_ACC_MODE_CMDID     = 0x0300, */
         WMI_MEM_READ_CMDID              = 0x0800,
         WMI_MEM_WR_CMDID                = 0x0801,
         WMI_ECHO_CMDID                  = 0x0803,
@@ -102,6 +104,8 @@ enum wmi_command_id {
         WMI_MAINTAIN_RESUME_CMDID       = 0x0851,
         WMI_RS_MGMT_CMDID               = 0x0852,
         WMI_RF_MGMT_CMDID               = 0x0853,
+        WMI_THERMAL_THROTTLING_CTRL_CMDID       = 0x0854,
+        WMI_THERMAL_THROTTLING_GET_STATUS_CMDID = 0x0855,
         /* Performance monitoring commands */
         WMI_BF_CTRL_CMDID               = 0x0862,
         WMI_NOTIFY_REQ_CMDID            = 0x0863,
@@ -136,6 +140,7 @@ enum wmi_command_id {
         WMI_EAPOL_TX_CMDID              = 0xf04c,
         WMI_MAC_ADDR_REQ_CMDID          = 0xf04d,
         WMI_FW_VER_CMDID                = 0xf04e,
+        WMI_PMC_CMDID                   = 0xf04f,
 };
 
 /*
@@ -283,8 +288,8 @@ enum wmi_scan_type {
         WMI_LONG_SCAN           = 0,
         WMI_SHORT_SCAN          = 1,
         WMI_PBC_SCAN            = 2,
-        WMI_ACTIVE_SCAN         = 3,
-        WMI_DIRECT_SCAN         = 4,
+        WMI_DIRECT_SCAN         = 3,
+        WMI_ACTIVE_SCAN         = 4,
 };
 
 struct wmi_start_scan_cmd {
@@ -375,6 +380,17 @@ struct wmi_rf_mgmt_cmd {
 } __packed;
 
 /*
+ * WMI_THERMAL_THROTTLING_CTRL_CMDID
+ */
+#define THERMAL_THROTTLING_USE_DEFAULT_MAX_TXOP_LENGTH  (0xFFFFFFFF)
+
+struct wmi_thermal_throttling_ctrl_cmd {
+        __le32 time_on_usec;
+        __le32 time_off_usec;
+        __le32 max_txop_length_usec;
+} __packed;
+
+/*
  * WMI_RF_RX_TEST_CMDID
  */
 struct wmi_rf_rx_test_cmd {
@@ -586,6 +602,7 @@ struct wmi_vring_ba_en_cmd {
         u8 ringid;
         u8 agg_max_wsize;
         __le16 ba_timeout;
+        u8 amsdu;
 } __packed;
 
 /*
@@ -647,6 +664,7 @@ enum wmi_cfg_rx_chain_cmd_action {
 enum wmi_cfg_rx_chain_cmd_decap_trans_type {
         WMI_DECAP_TYPE_802_3                    = 0,
         WMI_DECAP_TYPE_NATIVE_WIFI              = 1,
+        WMI_DECAP_TYPE_NONE                     = 2,
 };
 
 enum wmi_cfg_rx_chain_cmd_nwifi_ds_trans_type {
@@ -784,9 +802,17 @@ struct wmi_echo_cmd {
  *
  * Measure MAC and radio temperatures
  */
+
+/* Possible modes for temperature measurement */
+enum wmi_temperature_measure_mode {
+        TEMPERATURE_USE_OLD_VALUE       = 0x1,
+        TEMPERATURE_MEASURE_NOW         = 0x2,
+};
+
 struct wmi_temp_sense_cmd {
-        __le32 measure_marlon_m_en;
-        __le32 measure_marlon_r_en;
+        __le32 measure_baseband_en;
+        __le32 measure_rf_en;
+        __le32 measure_mode;
 } __packed;
 
 /*
@@ -842,6 +868,7 @@ enum wmi_event_id {
         WMI_BF_RXSS_MGMT_DONE_EVENTID           = 0x1839,
         WMI_RS_MGMT_DONE_EVENTID                = 0x1852,
         WMI_RF_MGMT_STATUS_EVENTID              = 0x1853,
+        WMI_THERMAL_THROTTLING_STATUS_EVENTID   = 0x1855,
         WMI_BF_SM_MGMT_DONE_EVENTID             = 0x1838,
         WMI_RX_MGMT_PACKET_EVENTID              = 0x1840,
         WMI_TX_MGMT_PACKET_EVENTID              = 0x1841,
@@ -858,6 +885,7 @@ enum wmi_event_id {
         WMI_FLASH_READ_DONE_EVENTID             = 0x1902,
         WMI_FLASH_WRITE_DONE_EVENTID            = 0x1903,
         /*P2P*/
+        WMI_P2P_CFG_DONE_EVENTID                = 0x1910,
         WMI_PORT_ALLOCATED_EVENTID              = 0x1911,
         WMI_PORT_DELETED_EVENTID                = 0x1912,
         WMI_LISTEN_STARTED_EVENTID              = 0x1914,
@@ -898,6 +926,15 @@ struct wmi_rf_mgmt_status_event {
 } __packed;
 
 /*
+ * WMI_THERMAL_THROTTLING_STATUS_EVENTID
+ */
+struct wmi_thermal_throttling_status_event {
+        __le32 time_on_usec;
+        __le32 time_off_usec;
+        __le32 max_txop_length_usec;
+} __packed;
+
+/*
  * WMI_GET_STATUS_DONE_EVENTID
  */
 struct wmi_get_status_done_event {
@@ -1052,14 +1089,23 @@ struct wmi_scan_complete_event {
 enum wmi_vring_ba_status {
         WMI_BA_AGREED                   = 0,
         WMI_BA_NON_AGREED               = 1,
+        /* BA_EN in middle of teardown flow */
+        WMI_BA_TD_WIP                   = 2,
+        /* BA_DIS or BA_EN in middle of BA SETUP flow */
+        WMI_BA_SETUP_WIP                = 3,
+        /* BA_EN when the BA session is already active */
+        WMI_BA_SESSION_ACTIVE           = 4,
+        /* BA_DIS when the BA session is not active */
+        WMI_BA_SESSION_NOT_ACTIVE       = 5,
 };
 
 struct wmi_vring_ba_status_event {
-        __le16 status;
+        __le16 status; /* enum wmi_vring_ba_status */
         u8 reserved[2];
         u8 ringid;
         u8 agg_wsize;
         __le16 ba_timeout;
+        u8 amsdu;
 } __packed;
 
 /*
@@ -1145,6 +1191,14 @@ struct wmi_get_pcp_channel_event {
 } __packed;
 
 /*
+ * WMI_P2P_CFG_DONE_EVENTID
+ */
+struct wmi_p2p_cfg_done_event {
+        u8 status;      /* wmi_fw_status */
+        u8 reserved[3];
+} __packed;
+
+/*
 * WMI_PORT_ALLOCATED_EVENTID
 */
 struct wmi_port_allocated_event {
@@ -1272,8 +1326,8 @@ struct wmi_echo_event {
  * Measure MAC and radio temperatures
  */
 struct wmi_temp_sense_done_event {
-        __le32 marlon_m_t1000;
-        __le32 marlon_r_t1000;
+        __le32 baseband_t1000;
+        __le32 rf_t1000;
 } __packed;
 
 #endif /* __WILOCITY_WMI_H__ */
diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c
index 9183f1cf89a7..55db9f03eb2a 100644
--- a/drivers/net/wireless/atmel.c
+++ b/drivers/net/wireless/atmel.c
@@ -45,7 +45,6 @@
 #include <linux/ptrace.h>
 #include <linux/slab.h>
 #include <linux/string.h>
-#include <linux/ctype.h>
 #include <linux/timer.h>
 #include <asm/byteorder.h>
 #include <asm/io.h>
@@ -2699,16 +2698,7 @@ static int atmel_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
                 domain[REGDOMAINSZ] = 0;
                 rc = -EINVAL;
                 for (i = 0; i < ARRAY_SIZE(channel_table); i++) {
-                        /* strcasecmp doesn't exist in the library */
-                        char *a = channel_table[i].name;
-                        char *b = domain;
-                        while (*a) {
-                                char c1 = *a++;
-                                char c2 = *b++;
-                                if (tolower(c1) != tolower(c2))
-                                        break;
-                        }
-                        if (!*a && !*b) {
+                        if (!strcasecmp(channel_table[i].name, domain)) {
                                 priv->config_reg_domain = channel_table[i].reg_domain;
                                 rc = 0;
                         }
diff --git a/drivers/net/wireless/b43/Kconfig b/drivers/net/wireless/b43/Kconfig
index 64a5b672e30a..759fb8d41fc9 100644
--- a/drivers/net/wireless/b43/Kconfig
+++ b/drivers/net/wireless/b43/Kconfig
@@ -166,6 +166,15 @@ config B43_PHY_LCN
 
           Say N, this is BROKEN and crashes driver.
 
+config B43_PHY_AC
+        bool "Support for AC-PHY (802.11ac) devices (BROKEN)"
+        depends on B43 && B43_BCMA && BROKEN
+        ---help---
+          This PHY type can be found in the following chipsets:
+          PCI: BCM4352, BCM4360
+
+          Say N, this is BROKEN and crashes driver.
+
 # This config option automatically enables b43 LEDS support,
 # if it's possible.
 config B43_LEDS
diff --git a/drivers/net/wireless/b43/Makefile b/drivers/net/wireless/b43/Makefile
index 9f7965aae93d..c624d4d90e4f 100644
--- a/drivers/net/wireless/b43/Makefile
+++ b/drivers/net/wireless/b43/Makefile
@@ -13,6 +13,7 @@ b43-$(CONFIG_B43_PHY_HT)	+= phy_ht.o
 b43-$(CONFIG_B43_PHY_HT)        += tables_phy_ht.o
 b43-$(CONFIG_B43_PHY_HT)        += radio_2059.o
 b43-$(CONFIG_B43_PHY_LCN)       += phy_lcn.o tables_phy_lcn.o
+b43-$(CONFIG_B43_PHY_AC)        += phy_ac.o
 b43-y                           += sysfs.o
 b43-y                           += xmit.o
 b43-y                           += dma.o
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index bb12586cd7cd..036552439816 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -500,6 +500,8 @@ enum {
 #define  B43_BCMA_IOCTL_PHY_BW_10MHZ    0x00000000      /* 10 MHz bandwidth, 40 MHz PHY */
 #define  B43_BCMA_IOCTL_PHY_BW_20MHZ    0x00000040      /* 20 MHz bandwidth, 80 MHz PHY */
 #define  B43_BCMA_IOCTL_PHY_BW_40MHZ    0x00000080      /* 40 MHz bandwidth, 160 MHz PHY */
+#define  B43_BCMA_IOCTL_PHY_BW_80MHZ    0x000000C0      /* 80 MHz bandwidth */
+#define B43_BCMA_IOCTL_DAC              0x00000300      /* Highspeed DAC mode control field */
 #define B43_BCMA_IOCTL_GMODE            0x00002000      /* G Mode Enable */
 
 /* BCMA 802.11 core specific IO status (BCMA_IOST) flags */
@@ -941,6 +943,7 @@ struct b43_wl {
         bool beacon1_uploaded;
         bool beacon_templates_virgin; /* Never wrote the templates? */
         struct work_struct beacon_update_trigger;
+        spinlock_t beacon_lock;
 
         /* The current QOS parameters for the 4 queues. */
         struct b43_qos_params qos_params[B43_QOS_QUEUE_NUM];
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 47731cb0d815..2c9088633ec6 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -1262,6 +1262,23 @@ static void b43_bcma_wireless_core_reset(struct b43_wldev *dev, bool gmode)
                 flags |= B43_BCMA_IOCTL_GMODE;
         b43_device_enable(dev, flags);
 
+        if (dev->phy.type == B43_PHYTYPE_AC) {
+                u16 tmp;
+
+                tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
+                tmp &= ~B43_BCMA_IOCTL_DAC;
+                tmp |= 0x100;
+                bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
+
+                tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
+                tmp &= ~B43_BCMA_IOCTL_PHY_CLKEN;
+                bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
+
+                tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
+                tmp |= B43_BCMA_IOCTL_PHY_CLKEN;
+                bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
+        }
+
         bcma_core_set_clockmode(dev->dev->bdev, BCMA_CLKMODE_FAST);
         b43_bcma_phy_reset(dev);
         bcma_core_pll_ctl(dev->dev->bdev, req, status, true);
@@ -1601,12 +1618,26 @@ static void b43_write_beacon_template(struct b43_wldev *dev,
         unsigned int rate;
         u16 ctl;
         int antenna;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
+        struct ieee80211_tx_info *info;
+        unsigned long flags;
+        struct sk_buff *beacon_skb;
 
-        bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
-        len = min_t(size_t, dev->wl->current_beacon->len,
-                  0x200 - sizeof(struct b43_plcp_hdr6));
+        spin_lock_irqsave(&dev->wl->beacon_lock, flags);
+        info = IEEE80211_SKB_CB(dev->wl->current_beacon);
         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
+        /* Clone the beacon, so it cannot go away, while we write it to hw. */
+        beacon_skb = skb_clone(dev->wl->current_beacon, GFP_ATOMIC);
+        spin_unlock_irqrestore(&dev->wl->beacon_lock, flags);
+
+        if (!beacon_skb) {
+                b43dbg(dev->wl, "Could not upload beacon. "
+                       "Failed to clone beacon skb.");
+                return;
+        }
+
+        bcn = (const struct ieee80211_mgmt *)(beacon_skb->data);
+        len = min_t(size_t, beacon_skb->len,
+                    0x200 - sizeof(struct b43_plcp_hdr6));
 
         b43_write_template_common(dev, (const u8 *)bcn,
                                   len, ram_offset, shm_size_offset, rate);
@@ -1674,6 +1705,8 @@ static void b43_write_beacon_template(struct b43_wldev *dev,
                                 B43_SHM_SH_DTIMPER, 0);
         }
         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
+
+        dev_kfree_skb_any(beacon_skb);
 }
 
 static void b43_upload_beacon0(struct b43_wldev *dev)
@@ -1790,13 +1823,13 @@ static void b43_beacon_update_trigger_work(struct work_struct *work)
         mutex_unlock(&wl->mutex);
 }
 
-/* Asynchronously update the packet templates in template RAM.
- * Locking: Requires wl->mutex to be locked. */
+/* Asynchronously update the packet templates in template RAM. */
 static void b43_update_templates(struct b43_wl *wl)
 {
-        struct sk_buff *beacon;
+        struct sk_buff *beacon, *old_beacon;
+        unsigned long flags;
 
-        /* This is the top half of the ansynchronous beacon update.
+        /* This is the top half of the asynchronous beacon update.
          * The bottom half is the beacon IRQ.
          * Beacon update must be asynchronous to avoid sending an
          * invalid beacon. This can happen for example, if the firmware
@@ -1810,12 +1843,17 @@ static void b43_update_templates(struct b43_wl *wl)
         if (unlikely(!beacon))
                 return;
 
-        if (wl->current_beacon)
-                dev_kfree_skb_any(wl->current_beacon);
+        spin_lock_irqsave(&wl->beacon_lock, flags);
+        old_beacon = wl->current_beacon;
         wl->current_beacon = beacon;
         wl->beacon0_uploaded = false;
         wl->beacon1_uploaded = false;
+        spin_unlock_irqrestore(&wl->beacon_lock, flags);
+
         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
+
+        if (old_beacon)
+                dev_kfree_skb_any(old_beacon);
 }
 
 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
@@ -4318,6 +4356,7 @@ redo:
         mutex_unlock(&wl->mutex);
         cancel_delayed_work_sync(&dev->periodic_work);
         cancel_work_sync(&wl->tx_work);
+        b43_leds_stop(dev);
         mutex_lock(&wl->mutex);
         dev = wl->current_dev;
         if (!dev || b43_status(dev) < B43_STAT_STARTED) {
@@ -4505,6 +4544,12 @@ static int b43_phy_versioning(struct b43_wldev *dev)
                         unsupported = 1;
                 break;
 #endif
+#ifdef CONFIG_B43_PHY_AC
+        case B43_PHYTYPE_AC:
+                if (phy_rev > 1)
+                        unsupported = 1;
+                break;
+#endif
         default:
                 unsupported = 1;
         }
@@ -4601,6 +4646,10 @@ static int b43_phy_versioning(struct b43_wldev *dev)
                 if (radio_id != 0x2064)
                         unsupported = 1;
                 break;
+        case B43_PHYTYPE_AC:
+                if (radio_id != 0x2069)
+                        unsupported = 1;
+                break;
         default:
                 B43_WARN_ON(1);
         }
@@ -5094,7 +5143,6 @@ static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
 {
         struct b43_wl *wl = hw_to_b43_wl(hw);
 
-        /* FIXME: add locking */
         b43_update_templates(wl);
 
         return 0;
@@ -5584,6 +5632,7 @@ static struct b43_wl *b43_wireless_init(struct b43_bus_dev *dev)
         wl->hw = hw;
         mutex_init(&wl->mutex);
         spin_lock_init(&wl->hardirq_lock);
+        spin_lock_init(&wl->beacon_lock);
         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
         INIT_WORK(&wl->tx_work, b43_tx_work);
diff --git a/drivers/net/wireless/b43/phy_ac.c b/drivers/net/wireless/b43/phy_ac.c
new file mode 100644
index 000000000000..e75633d67938
--- /dev/null
+++ b/drivers/net/wireless/b43/phy_ac.c
@@ -0,0 +1,92 @@
+/*
+ * Broadcom B43 wireless driver
+ * IEEE 802.11ac AC-PHY support
+ *
+ * Copyright (c) 2015 Rafał Miłecki <zajec5@gmail.com>
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+
+#include "b43.h"
+#include "phy_ac.h"
+
+/**************************************************
+ * Basic PHY ops
+ **************************************************/
+
+static int b43_phy_ac_op_allocate(struct b43_wldev *dev)
+{
+        struct b43_phy_ac *phy_ac;
+
+        phy_ac = kzalloc(sizeof(*phy_ac), GFP_KERNEL);
+        if (!phy_ac)
+                return -ENOMEM;
+        dev->phy.ac = phy_ac;
+
+        return 0;
+}
+
+static void b43_phy_ac_op_free(struct b43_wldev *dev)
+{
+        struct b43_phy *phy = &dev->phy;
+        struct b43_phy_ac *phy_ac = phy->ac;
+
+        kfree(phy_ac);
+        phy->ac = NULL;
+}
+
+static void b43_phy_ac_op_maskset(struct b43_wldev *dev, u16 reg, u16 mask,
+                                  u16 set)
+{
+        b43_write16f(dev, B43_MMIO_PHY_CONTROL, reg);
+        b43_write16(dev, B43_MMIO_PHY_DATA,
+                    (b43_read16(dev, B43_MMIO_PHY_DATA) & mask) | set);
+}
+
+static u16 b43_phy_ac_op_radio_read(struct b43_wldev *dev, u16 reg)
+{
+        b43_write16f(dev, B43_MMIO_RADIO24_CONTROL, reg);
+        return b43_read16(dev, B43_MMIO_RADIO24_DATA);
+}
+
+static void b43_phy_ac_op_radio_write(struct b43_wldev *dev, u16 reg,
+                                      u16 value)
+{
+        b43_write16f(dev, B43_MMIO_RADIO24_CONTROL, reg);
+        b43_write16(dev, B43_MMIO_RADIO24_DATA, value);
+}
+
+static unsigned int b43_phy_ac_op_get_default_chan(struct b43_wldev *dev)
+{
+        if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ)
+                return 11;
+        return 36;
+}
+
+static enum b43_txpwr_result
+b43_phy_ac_op_recalc_txpower(struct b43_wldev *dev, bool ignore_tssi)
+{
+        return B43_TXPWR_RES_DONE;
+}
+
+static void b43_phy_ac_op_adjust_txpower(struct b43_wldev *dev)
+{
+}
+
+/**************************************************
+ * PHY ops struct
+ **************************************************/
+
+const struct b43_phy_operations b43_phyops_ac = {
+        .allocate               = b43_phy_ac_op_allocate,
+        .free                   = b43_phy_ac_op_free,
+        .phy_maskset            = b43_phy_ac_op_maskset,
+        .radio_read             = b43_phy_ac_op_radio_read,
+        .radio_write            = b43_phy_ac_op_radio_write,
+        .get_default_chan       = b43_phy_ac_op_get_default_chan,
+        .recalc_txpower         = b43_phy_ac_op_recalc_txpower,
+        .adjust_txpower         = b43_phy_ac_op_adjust_txpower,
+};
diff --git a/drivers/net/wireless/b43/phy_ac.h b/drivers/net/wireless/b43/phy_ac.h
new file mode 100644
index 000000000000..d1ca79e0eb24
--- /dev/null
+++ b/drivers/net/wireless/b43/phy_ac.h
@@ -0,0 +1,38 @@
+#ifndef B43_PHY_AC_H_
+#define B43_PHY_AC_H_
+
+#include "phy_common.h"
+
+#define B43_PHY_AC_BBCFG                        0x001
+#define  B43_PHY_AC_BBCFG_RSTCCA                0x4000  /* Reset CCA */
+#define B43_PHY_AC_BANDCTL                      0x003   /* Band control */
+#define  B43_PHY_AC_BANDCTL_5GHZ                0x0001
+#define B43_PHY_AC_TABLE_ID                     0x00d
+#define B43_PHY_AC_TABLE_OFFSET                 0x00e
+#define B43_PHY_AC_TABLE_DATA1                  0x00f
+#define B43_PHY_AC_TABLE_DATA2                  0x010
+#define B43_PHY_AC_TABLE_DATA3                  0x011
+#define B43_PHY_AC_CLASSCTL                     0x140   /* Classifier control */
+#define  B43_PHY_AC_CLASSCTL_CCKEN              0x0001  /* CCK enable */
+#define  B43_PHY_AC_CLASSCTL_OFDMEN             0x0002  /* OFDM enable */
+#define  B43_PHY_AC_CLASSCTL_WAITEDEN           0x0004  /* Waited enable */
+#define B43_PHY_AC_BW1A                         0x371
+#define B43_PHY_AC_BW2                          0x372
+#define B43_PHY_AC_BW3                          0x373
+#define B43_PHY_AC_BW4                          0x374
+#define B43_PHY_AC_BW5                          0x375
+#define B43_PHY_AC_BW6                          0x376
+#define B43_PHY_AC_RFCTL_CMD                    0x408
+#define B43_PHY_AC_C1_CLIP                      0x6d4
+#define  B43_PHY_AC_C1_CLIP_DIS                 0x4000
+#define B43_PHY_AC_C2_CLIP                      0x8d4
+#define  B43_PHY_AC_C2_CLIP_DIS                 0x4000
+#define B43_PHY_AC_C3_CLIP                      0xad4
+#define  B43_PHY_AC_C3_CLIP_DIS                 0x4000
+
+struct b43_phy_ac {
+};
+
+extern const struct b43_phy_operations b43_phyops_ac;
+
+#endif /* B43_PHY_AC_H_ */
diff --git a/drivers/net/wireless/b43/phy_common.c b/drivers/net/wireless/b43/phy_common.c
index ee27b06074e1..ec2b9c577b90 100644
--- a/drivers/net/wireless/b43/phy_common.c
+++ b/drivers/net/wireless/b43/phy_common.c
@@ -33,6 +33,7 @@
 #include "phy_lp.h"
 #include "phy_ht.h"
 #include "phy_lcn.h"
+#include "phy_ac.h"
 #include "b43.h"
 #include "main.h"
 
@@ -70,6 +71,11 @@ int b43_phy_allocate(struct b43_wldev *dev)
                 phy->ops = &b43_phyops_lcn;
 #endif
                 break;
+        case B43_PHYTYPE_AC:
+#ifdef CONFIG_B43_PHY_AC
+                phy->ops = &b43_phyops_ac;
+#endif
+                break;
         }
         if (B43_WARN_ON(!phy->ops))
                 return -ENODEV;
@@ -572,7 +578,8 @@ void b43_phy_force_clock(struct b43_wldev *dev, bool force)
         u32 tmp;
 
         WARN_ON(dev->phy.type != B43_PHYTYPE_N &&
-                dev->phy.type != B43_PHYTYPE_HT);
+                dev->phy.type != B43_PHYTYPE_HT &&
+                dev->phy.type != B43_PHYTYPE_AC);
 
         switch (dev->dev->bus_type) {
 #ifdef CONFIG_B43_BCMA
diff --git a/drivers/net/wireless/b43/phy_common.h b/drivers/net/wireless/b43/phy_common.h
index 3912274f71e3..78d86526799e 100644
--- a/drivers/net/wireless/b43/phy_common.h
+++ b/drivers/net/wireless/b43/phy_common.h
@@ -222,6 +222,8 @@ struct b43_phy {
                 struct b43_phy_ht *ht;
                 /* LCN-PHY specific information */
                 struct b43_phy_lcn *lcn;
+                /* AC-PHY specific information */
+                struct b43_phy_ac *ac;
         };
 
         /* Band support flags. */
diff --git a/drivers/net/wireless/b43legacy/radio.c b/drivers/net/wireless/b43legacy/radio.c
index 896177690394..9501420340a9 100644
--- a/drivers/net/wireless/b43legacy/radio.c
+++ b/drivers/net/wireless/b43legacy/radio.c
@@ -1743,25 +1743,6 @@ u16 freq_r3A_value(u16 frequency)
         return value;
 }
 
-void b43legacy_radio_set_tx_iq(struct b43legacy_wldev *dev)
-{
-        static const u8 data_high[5] = { 0x00, 0x40, 0x80, 0x90, 0xD0 };
-        static const u8 data_low[5]  = { 0x00, 0x01, 0x05, 0x06, 0x0A };
-        u16 tmp = b43legacy_radio_read16(dev, 0x001E);
-        int i;
-        int j;
-
-        for (i = 0; i < 5; i++) {
-                for (j = 0; j < 5; j++) {
-                        if (tmp == (data_high[i] | data_low[j])) {
-                                b43legacy_phy_write(dev, 0x0069, (i - j) << 8 |
-                                                    0x00C0);
-                                return;
-                        }
-                }
-        }
-}
-
 int b43legacy_radio_selectchannel(struct b43legacy_wldev *dev,
                                   u8 channel,
                                   int synthetic_pu_workaround)
diff --git a/drivers/net/wireless/b43legacy/radio.h b/drivers/net/wireless/b43legacy/radio.h
index bccb3d7da682..dd2976d1d561 100644
--- a/drivers/net/wireless/b43legacy/radio.h
+++ b/drivers/net/wireless/b43legacy/radio.h
@@ -92,7 +92,6 @@ void b43legacy_nrssi_hw_write(struct b43legacy_wldev *dev, u16 offset, s16 val);
 void b43legacy_nrssi_hw_update(struct b43legacy_wldev *dev, u16 val);
 void b43legacy_nrssi_mem_update(struct b43legacy_wldev *dev);
 
-void b43legacy_radio_set_tx_iq(struct b43legacy_wldev *dev);
 u16 b43legacy_radio_calibrationvalue(struct b43legacy_wldev *dev);
 
 #endif /* B43legacy_RADIO_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
index 9880dae2a569..7944224e3fc9 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
@@ -97,25 +97,6 @@ static void brcmf_sdiod_dummy_irqhandler(struct sdio_func *func)
 {
 }
 
-static bool brcmf_sdiod_pm_resume_error(struct brcmf_sdio_dev *sdiodev)
-{
-        bool is_err = false;
-#ifdef CONFIG_PM_SLEEP
-        is_err = atomic_read(&sdiodev->suspend);
-#endif
-        return is_err;
-}
-
-static void brcmf_sdiod_pm_resume_wait(struct brcmf_sdio_dev *sdiodev,
-                                       wait_queue_head_t *wq)
-{
-#ifdef CONFIG_PM_SLEEP
-        int retry = 0;
-        while (atomic_read(&sdiodev->suspend) && retry++ != 30)
-                wait_event_timeout(*wq, false, HZ/100);
-#endif
-}
-
 int brcmf_sdiod_intr_register(struct brcmf_sdio_dev *sdiodev)
 {
         int ret = 0;
@@ -244,10 +225,6 @@ static int brcmf_sdiod_request_data(struct brcmf_sdio_dev *sdiodev, u8 fn,
         brcmf_dbg(SDIO, "rw=%d, func=%d, addr=0x%05x, nbytes=%d\n",
                   write, fn, addr, regsz);
 
-        brcmf_sdiod_pm_resume_wait(sdiodev, &sdiodev->request_word_wait);
-        if (brcmf_sdiod_pm_resume_error(sdiodev))
-                return -EIO;
-
         /* only allow byte access on F0 */
         if (WARN_ON(regsz > 1 && !fn))
                 return -EINVAL;
@@ -292,6 +269,12 @@ static int brcmf_sdiod_request_data(struct brcmf_sdio_dev *sdiodev, u8 fn,
         return ret;
 }
 
+static void brcmf_sdiod_nomedium_state(struct brcmf_sdio_dev *sdiodev)
+{
+        sdiodev->state = BRCMF_STATE_NOMEDIUM;
+        brcmf_bus_change_state(sdiodev->bus_if, BRCMF_BUS_DOWN);
+}
+
 static int brcmf_sdiod_regrw_helper(struct brcmf_sdio_dev *sdiodev, u32 addr,
                                    u8 regsz, void *data, bool write)
 {
@@ -299,7 +282,7 @@ static int brcmf_sdiod_regrw_helper(struct brcmf_sdio_dev *sdiodev, u32 addr,
         s32 retry = 0;
         int ret;
 
-        if (sdiodev->bus_if->state == BRCMF_BUS_NOMEDIUM)
+        if (sdiodev->state == BRCMF_STATE_NOMEDIUM)
                 return -ENOMEDIUM;
 
         /*
@@ -325,7 +308,7 @@ static int brcmf_sdiod_regrw_helper(struct brcmf_sdio_dev *sdiodev, u32 addr,
                  retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
 
         if (ret == -ENOMEDIUM)
-                brcmf_bus_change_state(sdiodev->bus_if, BRCMF_BUS_NOMEDIUM);
+                brcmf_sdiod_nomedium_state(sdiodev);
         else if (ret != 0) {
                 /*
                  * SleepCSR register access can fail when
@@ -348,7 +331,7 @@ brcmf_sdiod_set_sbaddr_window(struct brcmf_sdio_dev *sdiodev, u32 address)
         int err = 0, i;
         u8 addr[3];
 
-        if (sdiodev->bus_if->state == BRCMF_BUS_NOMEDIUM)
+        if (sdiodev->state == BRCMF_STATE_NOMEDIUM)
                 return -ENOMEDIUM;
 
         addr[0] = (address >> 8) & SBSDIO_SBADDRLOW_MASK;
@@ -462,10 +445,6 @@ static int brcmf_sdiod_buffrw(struct brcmf_sdio_dev *sdiodev, uint fn,
         unsigned int req_sz;
         int err;
 
-        brcmf_sdiod_pm_resume_wait(sdiodev, &sdiodev->request_buffer_wait);
-        if (brcmf_sdiod_pm_resume_error(sdiodev))
-                return -EIO;
-
         /* Single skb use the standard mmc interface */
         req_sz = pkt->len + 3;
         req_sz &= (uint)~3;
@@ -481,7 +460,7 @@ static int brcmf_sdiod_buffrw(struct brcmf_sdio_dev *sdiodev, uint fn,
                 err = sdio_readsb(sdiodev->func[fn], ((u8 *)(pkt->data)), addr,
                                   req_sz);
         if (err == -ENOMEDIUM)
-                brcmf_bus_change_state(sdiodev->bus_if, BRCMF_BUS_NOMEDIUM);
+                brcmf_sdiod_nomedium_state(sdiodev);
         return err;
 }
 
@@ -516,10 +495,6 @@ static int brcmf_sdiod_sglist_rw(struct brcmf_sdio_dev *sdiodev, uint fn,
         if (!pktlist->qlen)
                 return -EINVAL;
 
-        brcmf_sdiod_pm_resume_wait(sdiodev, &sdiodev->request_buffer_wait);
-        if (brcmf_sdiod_pm_resume_error(sdiodev))
-                return -EIO;
-
         target_list = pktlist;
         /* for host with broken sg support, prepare a page aligned list */
         __skb_queue_head_init(&local_list);
@@ -620,8 +595,7 @@ static int brcmf_sdiod_sglist_rw(struct brcmf_sdio_dev *sdiodev, uint fn,
 
                 ret = mmc_cmd.error ? mmc_cmd.error : mmc_dat.error;
                 if (ret == -ENOMEDIUM) {
-                        brcmf_bus_change_state(sdiodev->bus_if,
-                                               BRCMF_BUS_NOMEDIUM);
+                        brcmf_sdiod_nomedium_state(sdiodev);
                         break;
                 } else if (ret != 0) {
                         brcmf_err("CMD53 sg block %s failed %d\n",
@@ -996,18 +970,20 @@ out:
 }
 
 #define BRCMF_SDIO_DEVICE(dev_id)       \
-        {SDIO_DEVICE(BRCM_SDIO_VENDOR_ID_BROADCOM, dev_id)}
+        {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, dev_id)}
 
 /* devices we support, null terminated */
 static const struct sdio_device_id brcmf_sdmmc_ids[] = {
-        BRCMF_SDIO_DEVICE(BRCM_SDIO_43143_DEVICE_ID),
-        BRCMF_SDIO_DEVICE(BRCM_SDIO_43241_DEVICE_ID),
-        BRCMF_SDIO_DEVICE(BRCM_SDIO_4329_DEVICE_ID),
-        BRCMF_SDIO_DEVICE(BRCM_SDIO_4330_DEVICE_ID),
-        BRCMF_SDIO_DEVICE(BRCM_SDIO_4334_DEVICE_ID),
-        BRCMF_SDIO_DEVICE(BRCM_SDIO_43362_DEVICE_ID),
-        BRCMF_SDIO_DEVICE(BRCM_SDIO_4335_4339_DEVICE_ID),
-        BRCMF_SDIO_DEVICE(BRCM_SDIO_4354_DEVICE_ID),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43143),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43241),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4329),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4330),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4334),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43340),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43341),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43362),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4335_4339),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4354),
         { /* end: all zeroes */ }
 };
 MODULE_DEVICE_TABLE(sdio, brcmf_sdmmc_ids);
@@ -1074,9 +1050,9 @@ static int brcmf_ops_sdio_probe(struct sdio_func *func,
                 bus_if->wowl_supported = true;
 #endif
 
+        sdiodev->sleeping = false;
         atomic_set(&sdiodev->suspend, false);
-        init_waitqueue_head(&sdiodev->request_word_wait);
-        init_waitqueue_head(&sdiodev->request_buffer_wait);
+        init_waitqueue_head(&sdiodev->idle_wait);
 
         brcmf_dbg(SDIO, "F2 found, calling brcmf_sdiod_probe...\n");
         err = brcmf_sdiod_probe(sdiodev);
@@ -1138,12 +1114,23 @@ void brcmf_sdio_wowl_config(struct device *dev, bool enabled)
 #ifdef CONFIG_PM_SLEEP
 static int brcmf_ops_sdio_suspend(struct device *dev)
 {
-        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
-        struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
+        struct brcmf_bus *bus_if;
+        struct brcmf_sdio_dev *sdiodev;
         mmc_pm_flag_t sdio_flags;
 
         brcmf_dbg(SDIO, "Enter\n");
 
+        bus_if = dev_get_drvdata(dev);
+        sdiodev = bus_if->bus_priv.sdio;
+
+        /* wait for watchdog to go idle */
+        if (wait_event_timeout(sdiodev->idle_wait, sdiodev->sleeping,
+                               msecs_to_jiffies(3 * BRCMF_WD_POLL_MS)) == 0) {
+                brcmf_err("bus still active\n");
+                return -EBUSY;
+        }
+        /* disable watchdog */
+        brcmf_sdio_wd_timer(sdiodev->bus, 0);
         atomic_set(&sdiodev->suspend, true);
 
         if (sdiodev->wowl_enabled) {
@@ -1155,9 +1142,6 @@ static int brcmf_ops_sdio_suspend(struct device *dev)
                 if (sdio_set_host_pm_flags(sdiodev->func[1], sdio_flags))
                         brcmf_err("Failed to set pm_flags %x\n", sdio_flags);
         }
-
-        brcmf_sdio_wd_timer(sdiodev->bus, 0);
-
         return 0;
 }
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bus.h b/drivers/net/wireless/brcm80211/brcmfmac/bus.h
index ef344e47218a..89e6a4dc105e 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bus.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bus.h
@@ -33,11 +33,8 @@
 
 /* The level of bus communication with the dongle */
 enum brcmf_bus_state {
-        BRCMF_BUS_UNKNOWN,      /* Not determined yet */
-        BRCMF_BUS_NOMEDIUM,     /* No medium access to dongle */
         BRCMF_BUS_DOWN,         /* Not ready for frame transfers */
-        BRCMF_BUS_LOAD,         /* Download access only (CPU reset) */
-        BRCMF_BUS_DATA          /* Ready for frame transfers */
+        BRCMF_BUS_UP            /* Ready for frame transfers */
 };
 
 /* The level of bus communication with the dongle */
@@ -188,22 +185,6 @@ void brcmf_bus_wowl_config(struct brcmf_bus *bus, bool enabled)
                 bus->ops->wowl_config(bus->dev, enabled);
 }
 
-static inline bool brcmf_bus_ready(struct brcmf_bus *bus)
-{
-        return bus->state == BRCMF_BUS_LOAD || bus->state == BRCMF_BUS_DATA;
-}
-
-static inline void brcmf_bus_change_state(struct brcmf_bus *bus,
-                                          enum brcmf_bus_state new_state)
-{
-        /* NOMEDIUM is permanent */
-        if (bus->state == BRCMF_BUS_NOMEDIUM)
-                return;
-
-        brcmf_dbg(TRACE, "%d -> %d\n", bus->state, new_state);
-        bus->state = new_state;
-}
-
 /*
  * interface functions from common layer
  */
@@ -226,6 +207,9 @@ void brcmf_txflowblock(struct device *dev, bool state);
 /* Notify the bus has transferred the tx packet to firmware */
 void brcmf_txcomplete(struct device *dev, struct sk_buff *txp, bool success);
 
+/* Configure the "global" bus state used by upper layers */
+void brcmf_bus_change_state(struct brcmf_bus *bus, enum brcmf_bus_state state);
+
 int brcmf_bus_start(struct device *dev);
 s32 brcmf_iovar_data_set(struct device *dev, char *name, void *data, u32 len);
 void brcmf_bus_add_txhdrlen(struct device *dev, uint len);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
index 3aecc5f48719..b59b8c6c42ab 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
@@ -38,6 +38,7 @@
 #include "proto.h"
 #include "vendor.h"
 #include "bus.h"
+#include "common.h"
 
 #define BRCMF_SCAN_IE_LEN_MAX           2048
 #define BRCMF_PNO_VERSION               2
@@ -452,16 +453,16 @@ static void convert_key_from_CPU(struct brcmf_wsec_key *key,
 }
 
 static int
-send_key_to_dongle(struct net_device *ndev, struct brcmf_wsec_key *key)
+send_key_to_dongle(struct brcmf_if *ifp, struct brcmf_wsec_key *key)
 {
         int err;
         struct brcmf_wsec_key_le key_le;
 
         convert_key_from_CPU(key, &key_le);
 
-        brcmf_netdev_wait_pend8021x(ndev);
+        brcmf_netdev_wait_pend8021x(ifp);
 
-        err = brcmf_fil_bsscfg_data_set(netdev_priv(ndev), "wsec_key", &key_le,
+        err = brcmf_fil_bsscfg_data_set(ifp, "wsec_key", &key_le,
                                         sizeof(key_le));
 
         if (err)
@@ -1228,7 +1229,25 @@ static void brcmf_init_prof(struct brcmf_cfg80211_profile *prof)
         memset(prof, 0, sizeof(*prof));
 }
 
-static void brcmf_link_down(struct brcmf_cfg80211_vif *vif)
+static u16 brcmf_map_fw_linkdown_reason(const struct brcmf_event_msg *e)
+{
+        u16 reason;
+
+        switch (e->event_code) {
+        case BRCMF_E_DEAUTH:
+        case BRCMF_E_DEAUTH_IND:
+        case BRCMF_E_DISASSOC_IND:
+                reason = e->reason;
+                break;
+        case BRCMF_E_LINK:
+        default:
+                reason = 0;
+                break;
+        }
+        return reason;
+}
+
+static void brcmf_link_down(struct brcmf_cfg80211_vif *vif, u16 reason)
 {
         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
         s32 err = 0;
@@ -1243,7 +1262,8 @@ static void brcmf_link_down(struct brcmf_cfg80211_vif *vif)
                         brcmf_err("WLC_DISASSOC failed (%d)\n", err);
                 }
                 clear_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state);
-                cfg80211_disconnected(vif->wdev.netdev, 0, NULL, 0, GFP_KERNEL);
+                cfg80211_disconnected(vif->wdev.netdev, reason, NULL, 0,
+                                      GFP_KERNEL);
 
         }
         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state);
@@ -1413,7 +1433,7 @@ brcmf_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *ndev)
         if (!check_vif_up(ifp->vif))
                 return -EIO;
 
-        brcmf_link_down(ifp->vif);
+        brcmf_link_down(ifp->vif, WLAN_REASON_DEAUTH_LEAVING);
 
         brcmf_dbg(TRACE, "Exit\n");
 
@@ -1670,7 +1690,7 @@ brcmf_set_sharedkey(struct net_device *ndev,
         brcmf_dbg(CONN, "key length (%d) key index (%d) algo (%d)\n",
                   key.len, key.index, key.algo);
         brcmf_dbg(CONN, "key \"%s\"\n", key.data);
-        err = send_key_to_dongle(ndev, &key);
+        err = send_key_to_dongle(netdev_priv(ndev), &key);
         if (err)
                 return err;
 
@@ -2052,7 +2072,7 @@ brcmf_add_keyext(struct wiphy *wiphy, struct net_device *ndev,
         /* check for key index change */
         if (key.len == 0) {
                 /* key delete */
-                err = send_key_to_dongle(ndev, &key);
+                err = send_key_to_dongle(ifp, &key);
                 if (err)
                         brcmf_err("key delete error (%d)\n", err);
         } else {
@@ -2108,7 +2128,7 @@ brcmf_add_keyext(struct wiphy *wiphy, struct net_device *ndev,
                         brcmf_err("Invalid cipher (0x%x)\n", params->cipher);
                         return -EINVAL;
                 }
-                err = send_key_to_dongle(ndev, &key);
+                err = send_key_to_dongle(ifp, &key);
                 if (err)
                         brcmf_err("wsec_key error (%d)\n", err);
         }
@@ -2121,7 +2141,7 @@ brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
                     struct key_params *params)
 {
         struct brcmf_if *ifp = netdev_priv(ndev);
-        struct brcmf_wsec_key key;
+        struct brcmf_wsec_key *key;
         s32 val;
         s32 wsec;
         s32 err = 0;
@@ -2132,54 +2152,62 @@ brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
         if (!check_vif_up(ifp->vif))
                 return -EIO;
 
+        if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
+                /* we ignore this key index in this case */
+                brcmf_err("invalid key index (%d)\n", key_idx);
+                return -EINVAL;
+        }
+
         if (mac_addr &&
                 (params->cipher != WLAN_CIPHER_SUITE_WEP40) &&
                 (params->cipher != WLAN_CIPHER_SUITE_WEP104)) {
                 brcmf_dbg(TRACE, "Exit");
                 return brcmf_add_keyext(wiphy, ndev, key_idx, mac_addr, params);
         }
-        memset(&key, 0, sizeof(key));
 
-        key.len = (u32) params->key_len;
-        key.index = (u32) key_idx;
+        key = &ifp->vif->profile.key[key_idx];
+        memset(key, 0, sizeof(*key));
 
-        if (key.len > sizeof(key.data)) {
-                brcmf_err("Too long key length (%u)\n", key.len);
+        if (params->key_len > sizeof(key->data)) {
+                brcmf_err("Too long key length (%u)\n", params->key_len);
                 err = -EINVAL;
                 goto done;
         }
-        memcpy(key.data, params->key, key.len);
+        key->len = params->key_len;
+        key->index = key_idx;
 
-        key.flags = BRCMF_PRIMARY_KEY;
+        memcpy(key->data, params->key, key->len);
+
+        key->flags = BRCMF_PRIMARY_KEY;
         switch (params->cipher) {
         case WLAN_CIPHER_SUITE_WEP40:
-                key.algo = CRYPTO_ALGO_WEP1;
+                key->algo = CRYPTO_ALGO_WEP1;
                 val = WEP_ENABLED;
                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
                 break;
         case WLAN_CIPHER_SUITE_WEP104:
-                key.algo = CRYPTO_ALGO_WEP128;
+                key->algo = CRYPTO_ALGO_WEP128;
                 val = WEP_ENABLED;
                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
                 break;
         case WLAN_CIPHER_SUITE_TKIP:
                 if (!brcmf_is_apmode(ifp->vif)) {
                         brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
-                        memcpy(keybuf, &key.data[24], sizeof(keybuf));
-                        memcpy(&key.data[24], &key.data[16], sizeof(keybuf));
-                        memcpy(&key.data[16], keybuf, sizeof(keybuf));
+                        memcpy(keybuf, &key->data[24], sizeof(keybuf));
+                        memcpy(&key->data[24], &key->data[16], sizeof(keybuf));
+                        memcpy(&key->data[16], keybuf, sizeof(keybuf));
                 }
-                key.algo = CRYPTO_ALGO_TKIP;
+                key->algo = CRYPTO_ALGO_TKIP;
                 val = TKIP_ENABLED;
                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
                 break;
         case WLAN_CIPHER_SUITE_AES_CMAC:
-                key.algo = CRYPTO_ALGO_AES_CCM;
+                key->algo = CRYPTO_ALGO_AES_CCM;
                 val = AES_ENABLED;
                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
                 break;
         case WLAN_CIPHER_SUITE_CCMP:
-                key.algo = CRYPTO_ALGO_AES_CCM;
+                key->algo = CRYPTO_ALGO_AES_CCM;
                 val = AES_ENABLED;
                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_CCMP\n");
                 break;
@@ -2189,7 +2217,7 @@ brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
                 goto done;
         }
 
-        err = send_key_to_dongle(ndev, &key);
+        err = send_key_to_dongle(ifp, key);
         if (err)
                 goto done;
 
@@ -2222,7 +2250,7 @@ brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
         if (!check_vif_up(ifp->vif))
                 return -EIO;
 
-        if (key_idx >= DOT11_MAX_DEFAULT_KEYS) {
+        if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
                 /* we ignore this key index in this case */
                 brcmf_err("invalid key index (%d)\n", key_idx);
                 return -EINVAL;
@@ -2237,7 +2265,7 @@ brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
 
         /* Set the new key/index */
-        err = send_key_to_dongle(ndev, &key);
+        err = send_key_to_dongle(ifp, &key);
 
         brcmf_dbg(TRACE, "Exit\n");
         return err;
@@ -2305,6 +2333,39 @@ brcmf_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
         return -EOPNOTSUPP;
 }
 
+static void
+brcmf_cfg80211_reconfigure_wep(struct brcmf_if *ifp)
+{
+        s32 err;
+        u8 key_idx;
+        struct brcmf_wsec_key *key;
+        s32 wsec;
+
+        for (key_idx = 0; key_idx < BRCMF_MAX_DEFAULT_KEYS; key_idx++) {
+                key = &ifp->vif->profile.key[key_idx];
+                if ((key->algo == CRYPTO_ALGO_WEP1) ||
+                    (key->algo == CRYPTO_ALGO_WEP128))
+                        break;
+        }
+        if (key_idx == BRCMF_MAX_DEFAULT_KEYS)
+                return;
+
+        err = send_key_to_dongle(ifp, key);
+        if (err) {
+                brcmf_err("Setting WEP key failed (%d)\n", err);
+                return;
+        }
+        err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
+        if (err) {
+                brcmf_err("get wsec error (%d)\n", err);
+                return;
+        }
+        wsec |= WEP_ENABLED;
+        err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
+        if (err)
+                brcmf_err("set wsec error (%d)\n", err);
+}
+
 static s32
 brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
                            const u8 *mac, struct station_info *sinfo)
@@ -2333,10 +2394,10 @@ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
                         brcmf_err("GET STA INFO failed, %d\n", err);
                         goto done;
                 }
-                sinfo->filled = STATION_INFO_INACTIVE_TIME;
+                sinfo->filled = BIT(NL80211_STA_INFO_INACTIVE_TIME);
                 sinfo->inactive_time = le32_to_cpu(sta_info_le.idle) * 1000;
                 if (le32_to_cpu(sta_info_le.flags) & BRCMF_STA_ASSOC) {
-                        sinfo->filled |= STATION_INFO_CONNECTED_TIME;
+                        sinfo->filled |= BIT(NL80211_STA_INFO_CONNECTED_TIME);
                         sinfo->connected_time = le32_to_cpu(sta_info_le.in);
                 }
                 brcmf_dbg(TRACE, "STA idle time : %d ms, connected time :%d sec\n",
@@ -2354,7 +2415,7 @@ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
                         brcmf_err("Could not get rate (%d)\n", err);
                         goto done;
                 } else {
-                        sinfo->filled |= STATION_INFO_TX_BITRATE;
+                        sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
                         sinfo->txrate.legacy = rate * 5;
                         brcmf_dbg(CONN, "Rate %d Mbps\n", rate / 2);
                 }
@@ -2369,7 +2430,7 @@ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
                                 goto done;
                         } else {
                                 rssi = le32_to_cpu(scb_val.val);
-                                sinfo->filled |= STATION_INFO_SIGNAL;
+                                sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
                                 sinfo->signal = rssi;
                                 brcmf_dbg(CONN, "RSSI %d dBm\n", rssi);
                         }
@@ -2396,7 +2457,7 @@ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
                                 brcmf_dbg(CONN, "DTIM peroid %d\n",
                                           dtim_period);
                         }
-                        sinfo->filled |= STATION_INFO_BSS_PARAM;
+                        sinfo->filled |= BIT(NL80211_STA_INFO_BSS_PARAM);
                 }
         } else
                 err = -EPERM;
@@ -2999,7 +3060,7 @@ static s32 brcmf_cfg80211_suspend(struct wiphy *wiphy,
                          * disassociate from AP to save power while system is
                          * in suspended state
                          */
-                        brcmf_link_down(vif);
+                        brcmf_link_down(vif, WLAN_REASON_UNSPECIFIED);
                         /* Make sure WPA_Supplicant receives all the event
                          * generated due to DISASSOC call to the fw to keep
                          * the state fw and WPA_Supplicant state consistent
@@ -3695,17 +3756,12 @@ static u32
 brcmf_vndr_ie(u8 *iebuf, s32 pktflag, u8 *ie_ptr, u32 ie_len, s8 *add_del_cmd)
 {
 
-        __le32 iecount_le;
-        __le32 pktflag_le;
-
         strncpy(iebuf, add_del_cmd, VNDR_IE_CMD_LEN - 1);
         iebuf[VNDR_IE_CMD_LEN - 1] = '\0';
 
-        iecount_le = cpu_to_le32(1);
-        memcpy(&iebuf[VNDR_IE_COUNT_OFFSET], &iecount_le, sizeof(iecount_le));
+        put_unaligned_le32(1, &iebuf[VNDR_IE_COUNT_OFFSET]);
 
-        pktflag_le = cpu_to_le32(pktflag);
-        memcpy(&iebuf[VNDR_IE_PKTFLAG_OFFSET], &pktflag_le, sizeof(pktflag_le));
+        put_unaligned_le32(pktflag, &iebuf[VNDR_IE_PKTFLAG_OFFSET]);
 
         memcpy(&iebuf[VNDR_IE_VSIE_OFFSET], ie_ptr, ie_len);
 
@@ -3924,6 +3980,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
         struct brcmf_if *ifp = netdev_priv(ndev);
         const struct brcmf_tlv *ssid_ie;
+        const struct brcmf_tlv *country_ie;
         struct brcmf_ssid_le ssid_le;
         s32 err = -EPERM;
         const struct brcmf_tlv *rsn_ie;
@@ -3933,6 +3990,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
         struct brcmf_fil_bss_enable_le bss_enable;
         u16 chanspec;
         bool mbss;
+        int is_11d;
 
         brcmf_dbg(TRACE, "ctrlchn=%d, center=%d, bw=%d, beacon_interval=%d, dtim_period=%d,\n",
                   settings->chandef.chan->hw_value,
@@ -3941,10 +3999,16 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
         brcmf_dbg(TRACE, "ssid=%s(%zu), auth_type=%d, inactivity_timeout=%d\n",
                   settings->ssid, settings->ssid_len, settings->auth_type,
                   settings->inactivity_timeout);
-
         dev_role = ifp->vif->wdev.iftype;
         mbss = ifp->vif->mbss;
 
+        /* store current 11d setting */
+        brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_REGULATORY, &ifp->vif->is_11d);
+        country_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
+                                      settings->beacon.tail_len,
+                                      WLAN_EID_COUNTRY);
+        is_11d = country_ie ? 1 : 0;
+
         memset(&ssid_le, 0, sizeof(ssid_le));
         if (settings->ssid == NULL || settings->ssid_len == 0) {
                 ie_offset = DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
@@ -4010,6 +4074,14 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
                         goto exit;
                 }
 
+                if (is_11d != ifp->vif->is_11d) {
+                        err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
+                                                    is_11d);
+                        if (err < 0) {
+                                brcmf_err("Regulatory Set Error, %d\n", err);
+                                goto exit;
+                        }
+                }
                 if (settings->beacon_interval) {
                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD,
                                                     settings->beacon_interval);
@@ -4042,6 +4114,10 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
                         brcmf_err("SET INFRA error %d\n", err);
                         goto exit;
                 }
+        } else if (WARN_ON(is_11d != ifp->vif->is_11d)) {
+                /* Multiple-BSS should use same 11d configuration */
+                err = -EINVAL;
+                goto exit;
         }
         if (dev_role == NL80211_IFTYPE_AP) {
                 if ((brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) && (!mbss))
@@ -4057,6 +4133,10 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
                         brcmf_err("BRCMF_C_UP error (%d)\n", err);
                         goto exit;
                 }
+                /* On DOWN the firmware removes the WEP keys, reconfigure
+                 * them if they were set.
+                 */
+                brcmf_cfg80211_reconfigure_wep(ifp);
 
                 memset(&join_params, 0, sizeof(join_params));
                 /* join parameters starts with ssid */
@@ -4133,6 +4213,11 @@ static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
                         brcmf_err("setting INFRA mode failed %d\n", err);
                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
                         brcmf_fil_iovar_int_set(ifp, "mbss", 0);
+                err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
+                                            ifp->vif->is_11d);
+                if (err < 0)
+                        brcmf_err("restoring REGULATORY setting failed %d\n",
+                                  err);
                 /* Bring device back up so it can be used again */
                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
                 if (err < 0)
@@ -4197,6 +4282,34 @@ brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
         return err;
 }
 
+static int
+brcmf_cfg80211_change_station(struct wiphy *wiphy, struct net_device *ndev,
+                              const u8 *mac, struct station_parameters *params)
+{
+        struct brcmf_if *ifp = netdev_priv(ndev);
+        s32 err;
+
+        brcmf_dbg(TRACE, "Enter, MAC %pM, mask 0x%04x set 0x%04x\n", mac,
+                  params->sta_flags_mask, params->sta_flags_set);
+
+        /* Ignore all 00 MAC */
+        if (is_zero_ether_addr(mac))
+                return 0;
+
+        if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
+                return 0;
+
+        if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED))
+                err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_AUTHORIZE,
+                                             (void *)mac, ETH_ALEN);
+        else
+                err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_DEAUTHORIZE,
+                                             (void *)mac, ETH_ALEN);
+        if (err < 0)
+                brcmf_err("Setting SCB (de-)authorize failed, %d\n", err);
+
+        return err;
+}
 
 static void
 brcmf_cfg80211_mgmt_frame_register(struct wiphy *wiphy,
@@ -4471,6 +4584,7 @@ static struct cfg80211_ops wl_cfg80211_ops = {
         .stop_ap = brcmf_cfg80211_stop_ap,
         .change_beacon = brcmf_cfg80211_change_beacon,
         .del_station = brcmf_cfg80211_del_station,
+        .change_station = brcmf_cfg80211_change_station,
         .sched_scan_start = brcmf_cfg80211_sched_scan_start,
         .sched_scan_stop = brcmf_cfg80211_sched_scan_stop,
         .mgmt_frame_register = brcmf_cfg80211_mgmt_frame_register,
@@ -4778,7 +4892,6 @@ brcmf_notify_connect_status_ap(struct brcmf_cfg80211_info *cfg,
         if (((event == BRCMF_E_ASSOC_IND) || (event == BRCMF_E_REASSOC_IND)) &&
             (reason == BRCMF_E_STATUS_SUCCESS)) {
                 memset(&sinfo, 0, sizeof(sinfo));
-                sinfo.filled = STATION_INFO_ASSOC_REQ_IES;
                 if (!data) {
                         brcmf_err("No IEs present in ASSOC/REASSOC_IND");
                         return -EINVAL;
@@ -4833,7 +4946,7 @@ brcmf_notify_connect_status(struct brcmf_if *ifp,
                 if (!brcmf_is_ibssmode(ifp->vif)) {
                         brcmf_bss_connect_done(cfg, ndev, e, false);
                 }
-                brcmf_link_down(ifp->vif);
+                brcmf_link_down(ifp->vif, brcmf_map_fw_linkdown_reason(e));
                 brcmf_init_prof(ndev_to_prof(ndev));
                 if (ndev != cfg_to_ndev(cfg))
                         complete(&cfg->vif_disabled);
@@ -5774,7 +5887,7 @@ static s32 __brcmf_cfg80211_down(struct brcmf_if *ifp)
          * from AP to save power
          */
         if (check_vif_up(ifp->vif)) {
-                brcmf_link_down(ifp->vif);
+                brcmf_link_down(ifp->vif, WLAN_REASON_UNSPECIFIED);
 
                 /* Make sure WPA_Supplicant receives all the event
                    generated due to DISASSOC call to the fw to keep
@@ -5876,6 +5989,29 @@ int brcmf_cfg80211_wait_vif_event_timeout(struct brcmf_cfg80211_info *cfg,
                                   vif_event_equals(event, action), timeout);
 }
 
+static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
+                                        struct regulatory_request *req)
+{
+        struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
+        struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
+        struct brcmf_fil_country_le ccreq;
+        int i;
+
+        brcmf_dbg(TRACE, "enter: initiator=%d, alpha=%c%c\n", req->initiator,
+                  req->alpha2[0], req->alpha2[1]);
+
+        /* ignore non-ISO3166 country codes */
+        for (i = 0; i < sizeof(req->alpha2); i++)
+                if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
+                        brcmf_err("not a ISO3166 code\n");
+                        return;
+                }
+        memset(&ccreq, 0, sizeof(ccreq));
+        ccreq.rev = cpu_to_le32(-1);
+        memcpy(ccreq.ccode, req->alpha2, sizeof(req->alpha2));
+        brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq));
+}
+
 static void brcmf_free_wiphy(struct wiphy *wiphy)
 {
         kfree(wiphy->iface_combinations);
@@ -5952,6 +6088,7 @@ struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
                 goto priv_out;
 
         brcmf_dbg(INFO, "Registering custom regulatory\n");
+        wiphy->reg_notifier = brcmf_cfg80211_reg_notifier;
         wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
         wiphy_apply_custom_regulatory(wiphy, &brcmf_regdom);
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.h b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.h
index 9e98b8d52757..d9e6d01b2b69 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.h
@@ -75,6 +75,8 @@
 
 #define BRCMF_VNDR_IE_P2PAF_SHIFT       12
 
+#define BRCMF_MAX_DEFAULT_KEYS          4
+
 
 /**
  * enum brcmf_scan_status - scan engine status
@@ -125,11 +127,13 @@ struct brcmf_cfg80211_security {
  * @ssid: ssid of associated/associating ap.
  * @bssid: bssid of joined/joining ibss.
  * @sec: security information.
+ * @key: key information
  */
 struct brcmf_cfg80211_profile {
         struct brcmf_ssid ssid;
         u8 bssid[ETH_ALEN];
         struct brcmf_cfg80211_security sec;
+        struct brcmf_wsec_key key[BRCMF_MAX_DEFAULT_KEYS];
 };
 
 /**
@@ -196,6 +200,7 @@ struct brcmf_cfg80211_vif {
         struct list_head list;
         u16 mgmt_rx_reg;
         bool mbss;
+        int is_11d;
 };
 
 /* association inform */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/chip.c b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
index ddae0b5e56ec..04d2ca0d87d6 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/chip.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
@@ -101,14 +101,7 @@
 /* ARM Cortex M3 core, ID 0x82a */
 #define BCM4329_CORE_ARM_BASE           0x18002000
 #define BCM4329_RAMSIZE                 0x48000
-
 /* bcm43143 */
-/* SDIO device core */
-#define BCM43143_CORE_BUS_BASE          0x18002000
-/* internal memory core */
-#define BCM43143_CORE_SOCRAM_BASE       0x18004000
-/* ARM Cortex M3 core, ID 0x82a */
-#define BCM43143_CORE_ARM_BASE          0x18003000
 #define BCM43143_RAMSIZE                0x70000
 
 #define CORE_SB(base, field) \
@@ -164,13 +157,6 @@ struct brcmf_core_priv {
         struct brcmf_chip_priv *chip;
 };
 
-/* ARM CR4 core specific control flag bits */
-#define ARMCR4_BCMA_IOCTL_CPUHALT       0x0020
-
-/* D11 core specific control flag bits */
-#define D11_BCMA_IOCTL_PHYCLOCKEN       0x0004
-#define D11_BCMA_IOCTL_PHYRESET         0x0008
-
 struct brcmf_chip_priv {
         struct brcmf_chip pub;
         const struct brcmf_buscore_ops *ops;
@@ -495,6 +481,7 @@ static void brcmf_chip_get_raminfo(struct brcmf_chip_priv *ci)
                 ci->pub.ramsize = 0x48000;
                 break;
         case BRCM_CC_4334_CHIP_ID:
+        case BRCM_CC_43340_CHIP_ID:
                 ci->pub.ramsize = 0x80000;
                 break;
         case BRCM_CC_4335_CHIP_ID:
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/common.c b/drivers/net/wireless/brcm80211/brcmfmac/common.c
index 1861a13e8d03..fe54844c75e0 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/common.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/common.c
@@ -25,6 +25,9 @@
 #include "fwil.h"
 #include "fwil_types.h"
 #include "tracepoint.h"
+#include "common.h"
+
+const u8 ALLFFMAC[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
 
 #define BRCMF_DEFAULT_BCN_TIMEOUT       3
 #define BRCMF_DEFAULT_SCAN_CHANNEL_TIME 40
@@ -38,6 +41,8 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
         s8 eventmask[BRCMF_EVENTING_MASK_LEN];
         u8 buf[BRCMF_DCMD_SMLEN];
         struct brcmf_join_pref_params join_pref_params[2];
+        struct brcmf_rev_info_le revinfo;
+        struct brcmf_rev_info *ri;
         char *ptr;
         s32 err;
 
@@ -45,12 +50,37 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
         err = brcmf_fil_iovar_data_get(ifp, "cur_etheraddr", ifp->mac_addr,
                                        sizeof(ifp->mac_addr));
         if (err < 0) {
-                brcmf_err("Retreiving cur_etheraddr failed, %d\n",
-                          err);
+                brcmf_err("Retreiving cur_etheraddr failed, %d\n", err);
                 goto done;
         }
         memcpy(ifp->drvr->mac, ifp->mac_addr, sizeof(ifp->drvr->mac));
 
+        err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_REVINFO,
+                                     &revinfo, sizeof(revinfo));
+        ri = &ifp->drvr->revinfo;
+        if (err < 0) {
+                brcmf_err("retrieving revision info failed, %d\n", err);
+        } else {
+                ri->vendorid = le32_to_cpu(revinfo.vendorid);
+                ri->deviceid = le32_to_cpu(revinfo.deviceid);
+                ri->radiorev = le32_to_cpu(revinfo.radiorev);
+                ri->chiprev = le32_to_cpu(revinfo.chiprev);
+                ri->corerev = le32_to_cpu(revinfo.corerev);
+                ri->boardid = le32_to_cpu(revinfo.boardid);
+                ri->boardvendor = le32_to_cpu(revinfo.boardvendor);
+                ri->boardrev = le32_to_cpu(revinfo.boardrev);
+                ri->driverrev = le32_to_cpu(revinfo.driverrev);
+                ri->ucoderev = le32_to_cpu(revinfo.ucoderev);
+                ri->bus = le32_to_cpu(revinfo.bus);
+                ri->chipnum = le32_to_cpu(revinfo.chipnum);
+                ri->phytype = le32_to_cpu(revinfo.phytype);
+                ri->phyrev = le32_to_cpu(revinfo.phyrev);
+                ri->anarev = le32_to_cpu(revinfo.anarev);
+                ri->chippkg = le32_to_cpu(revinfo.chippkg);
+                ri->nvramrev = le32_to_cpu(revinfo.nvramrev);
+        }
+        ri->result = err;
+
         /* query for 'ver' to get version info from firmware */
         memset(buf, 0, sizeof(buf));
         strcpy(buf, "ver");
diff --git a/drivers/net/wireless/ath/wil6210/wil_platform_msm.h b/drivers/net/wireless/brcm80211/brcmfmac/common.h
index 2f2229edb498..0d39d80cee28 100644
--- a/drivers/net/wireless/ath/wil6210/wil_platform_msm.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/common.h
@@ -1,5 +1,4 @@
-/*
- * Copyright (c) 2014 Qualcomm Atheros, Inc.
+/* Copyright (c) 2014 Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -7,18 +6,15 @@
  *
  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
+#ifndef BRCMFMAC_COMMON_H
+#define BRCMFMAC_COMMON_H
 
-#ifndef __WIL_PLATFORM__MSM_H__
-#define __WIL_PLATFORM_MSM_H__
+extern const u8 ALLFFMAC[ETH_ALEN];
 
-#include "wil_platform.h"
-
-void *wil_platform_msm_init(struct device *dev, struct wil_platform_ops *ops);
-
-#endif /* __WIL_PLATFORM__MSM_H__ */
+#endif /* BRCMFMAC_COMMON_H */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/commonring.h b/drivers/net/wireless/brcm80211/brcmfmac/commonring.h
index 002336e35764..3d404016a92e 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/commonring.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/commonring.h
@@ -37,6 +37,8 @@ struct brcmf_commonring {
         unsigned long flags;
         bool inited;
         bool was_full;
+
+        atomic_t outstanding_tx;
 };
 
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/core.c b/drivers/net/wireless/brcm80211/brcmfmac/core.c
index effe6d7831d9..2d6e2cc1b12c 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
@@ -197,7 +197,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
         brcmf_dbg(DATA, "Enter, idx=%d\n", ifp->bssidx);
 
         /* Can the device send data? */
-        if (drvr->bus_if->state != BRCMF_BUS_DATA) {
+        if (drvr->bus_if->state != BRCMF_BUS_UP) {
                 brcmf_err("xmit rejected state=%d\n", drvr->bus_if->state);
                 netif_stop_queue(ndev);
                 dev_kfree_skb(skb);
@@ -601,9 +601,12 @@ static void brcmf_ethtool_get_drvinfo(struct net_device *ndev,
 {
         struct brcmf_if *ifp = netdev_priv(ndev);
         struct brcmf_pub *drvr = ifp->drvr;
+        char drev[BRCMU_DOTREV_LEN] = "n/a";
 
+        if (drvr->revinfo.result == 0)
+                brcmu_dotrev_str(drvr->revinfo.driverrev, drev);
         strlcpy(info->driver, KBUILD_MODNAME, sizeof(info->driver));
-        snprintf(info->version, sizeof(info->version), "n/a");
+        strlcpy(info->version, drev, sizeof(info->version));
         strlcpy(info->fw_version, drvr->fwver, sizeof(info->fw_version));
         strlcpy(info->bus_info, dev_name(drvr->bus_if->dev),
                 sizeof(info->bus_info));
@@ -637,7 +640,7 @@ static int brcmf_netdev_open(struct net_device *ndev)
         brcmf_dbg(TRACE, "Enter, idx=%d\n", ifp->bssidx);
 
         /* If bus is not ready, can't continue */
-        if (bus_if->state != BRCMF_BUS_DATA) {
+        if (bus_if->state != BRCMF_BUS_UP) {
                 brcmf_err("failed bus is not ready\n");
                 return -EAGAIN;
         }
@@ -964,13 +967,20 @@ int brcmf_bus_start(struct device *dev)
                 p2p_ifp = NULL;
 
         /* signal bus ready */
-        brcmf_bus_change_state(bus_if, BRCMF_BUS_DATA);
+        brcmf_bus_change_state(bus_if, BRCMF_BUS_UP);
 
         /* Bus is ready, do any initialization */
         ret = brcmf_c_preinit_dcmds(ifp);
         if (ret < 0)
                 goto fail;
 
+        /* assure we have chipid before feature attach */
+        if (!bus_if->chip) {
+                bus_if->chip = drvr->revinfo.chipnum;
+                bus_if->chiprev = drvr->revinfo.chiprev;
+                brcmf_dbg(INFO, "firmware revinfo: chip %x (%d) rev %d\n",
+                          bus_if->chip, bus_if->chip, bus_if->chiprev);
+        }
         brcmf_feat_attach(drvr);
 
         ret = brcmf_fws_init(drvr);
@@ -1093,9 +1103,8 @@ static int brcmf_get_pend_8021x_cnt(struct brcmf_if *ifp)
         return atomic_read(&ifp->pend_8021x_cnt);
 }
 
-int brcmf_netdev_wait_pend8021x(struct net_device *ndev)
+int brcmf_netdev_wait_pend8021x(struct brcmf_if *ifp)
 {
-        struct brcmf_if *ifp = netdev_priv(ndev);
         int err;
 
         err = wait_event_timeout(ifp->pend_8021x_wait,
@@ -1107,6 +1116,27 @@ int brcmf_netdev_wait_pend8021x(struct net_device *ndev)
         return !err;
 }
 
+void brcmf_bus_change_state(struct brcmf_bus *bus, enum brcmf_bus_state state)
+{
+        struct brcmf_pub *drvr = bus->drvr;
+        struct net_device *ndev;
+        int ifidx;
+
+        brcmf_dbg(TRACE, "%d -> %d\n", bus->state, state);
+        bus->state = state;
+
+        if (state == BRCMF_BUS_UP) {
+                for (ifidx = 0; ifidx < BRCMF_MAX_IFS; ifidx++) {
+                        if ((drvr->iflist[ifidx]) &&
+                            (drvr->iflist[ifidx]->ndev)) {
+                                ndev = drvr->iflist[ifidx]->ndev;
+                                if (netif_queue_stopped(ndev))
+                                        netif_wake_queue(ndev);
+                        }
+                }
+        }
+}
+
 static void brcmf_driver_register(struct work_struct *work)
 {
 #ifdef CONFIG_BRCMFMAC_SDIO
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/core.h b/drivers/net/wireless/brcm80211/brcmfmac/core.h
index 23f74b139cc8..fd74a9c6e9ac 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/core.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.h
@@ -29,8 +29,6 @@
 /* For supporting multiple interfaces */
 #define BRCMF_MAX_IFS   16
 
-#define DOT11_MAX_DEFAULT_KEYS  4
-
 /* Small, medium and maximum buffer size for dcmd
  */
 #define BRCMF_DCMD_SMLEN        256
@@ -73,6 +71,35 @@ struct brcmf_proto;	/* device communication protocol info */
 struct brcmf_cfg80211_dev; /* cfg80211 device info */
 struct brcmf_fws_info; /* firmware signalling info */
 
+/*
+ * struct brcmf_rev_info
+ *
+ * The result field stores the error code of the
+ * revision info request from firmware. For the
+ * other fields see struct brcmf_rev_info_le in
+ * fwil_types.h
+ */
+struct brcmf_rev_info {
+        int result;
+        u32 vendorid;
+        u32 deviceid;
+        u32 radiorev;
+        u32 chiprev;
+        u32 corerev;
+        u32 boardid;
+        u32 boardvendor;
+        u32 boardrev;
+        u32 driverrev;
+        u32 ucoderev;
+        u32 bus;
+        u32 chipnum;
+        u32 phytype;
+        u32 phyrev;
+        u32 anarev;
+        u32 chippkg;
+        u32 nvramrev;
+};
+
 /* Common structure for module and instance linkage */
 struct brcmf_pub {
         /* Linkage ponters */
@@ -106,6 +133,7 @@ struct brcmf_pub {
         u32 feat_flags;
         u32 chip_quirks;
 
+        struct brcmf_rev_info revinfo;
 #ifdef DEBUG
         struct dentry *dbgfs_dir;
 #endif
@@ -167,7 +195,7 @@ struct brcmf_skb_reorder_data {
         u8 *reorder;
 };
 
-int brcmf_netdev_wait_pend8021x(struct net_device *ndev);
+int brcmf_netdev_wait_pend8021x(struct brcmf_if *ifp);
 
 /* Return pointer to interface name */
 char *brcmf_ifname(struct brcmf_pub *drvr, int idx);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/firmware.c b/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
index 1ff787d1a36b..9cb99152ad17 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
@@ -103,7 +103,11 @@ static enum nvram_parser_state brcmf_nvram_handle_key(struct nvram_parser *nvp)
 
         c = nvp->fwnv->data[nvp->pos];
         if (c == '=') {
-                st = VALUE;
+                /* ignore RAW1 by treating as comment */
+                if (strncmp(&nvp->fwnv->data[nvp->entry], "RAW1", 4) == 0)
+                        st = COMMENT;
+                else
+                        st = VALUE;
         } else if (!is_nvram_char(c)) {
                 brcmf_dbg(INFO, "warning: ln=%d:col=%d: '=' expected, skip invalid key entry\n",
                           nvp->line, nvp->column);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/flowring.c b/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
index 44f3a84d1999..910fbb561469 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
@@ -25,6 +25,7 @@
 #include "proto.h"
 #include "flowring.h"
 #include "msgbuf.h"
+#include "common.h"
 
 
 #define BRCMF_FLOWRING_HIGH             1024
@@ -34,9 +35,6 @@
 #define BRCMF_FLOWRING_HASH_AP(da, fifo, ifidx) (da[5] + fifo + ifidx * 16)
 #define BRCMF_FLOWRING_HASH_STA(fifo, ifidx) (fifo + ifidx * 16)
 
-static const u8 ALLZEROMAC[ETH_ALEN] = { 0, 0, 0, 0, 0, 0 };
-static const u8 ALLFFMAC[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
-
 static const u8 brcmf_flowring_prio2fifo[] = {
         1,
         0,
@@ -137,7 +135,7 @@ u32 brcmf_flowring_create(struct brcmf_flowring *flow, u8 da[ETH_ALEN],
         hash = flow->hash;
         for (i = 0; i < BRCMF_FLOWRING_HASHSIZE; i++) {
                 if ((hash[hash_idx].ifidx == BRCMF_FLOWRING_INVALID_IFIDX) &&
-                    (memcmp(hash[hash_idx].mac, ALLZEROMAC, ETH_ALEN) == 0)) {
+                    (is_zero_ether_addr(hash[hash_idx].mac))) {
                         found = true;
                         break;
                 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwil.c b/drivers/net/wireless/brcm80211/brcmfmac/fwil.c
index 03f2c406a17b..dcfa0bb149ce 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwil.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil.c
@@ -109,7 +109,7 @@ brcmf_fil_cmd_data(struct brcmf_if *ifp, u32 cmd, void *data, u32 len, bool set)
         struct brcmf_pub *drvr = ifp->drvr;
         s32 err;
 
-        if (drvr->bus_if->state != BRCMF_BUS_DATA) {
+        if (drvr->bus_if->state != BRCMF_BUS_UP) {
                 brcmf_err("bus is down. we have nothing to do.\n");
                 return -EIO;
         }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwil.h b/drivers/net/wireless/brcm80211/brcmfmac/fwil.h
index a30be683f4a1..5434dcf64f7d 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwil.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil.h
@@ -43,6 +43,8 @@
 #define BRCMF_C_SET_RADIO                       38
 #define BRCMF_C_GET_PHYTYPE                     39
 #define BRCMF_C_SET_KEY                         45
+#define BRCMF_C_GET_REGULATORY                  46
+#define BRCMF_C_SET_REGULATORY                  47
 #define BRCMF_C_SET_PASSIVE_SCAN                49
 #define BRCMF_C_SCAN                            50
 #define BRCMF_C_SCAN_RESULTS                    51
@@ -57,9 +59,12 @@
 #define BRCMF_C_SET_COUNTRY                     84
 #define BRCMF_C_GET_PM                          85
 #define BRCMF_C_SET_PM                          86
+#define BRCMF_C_GET_REVINFO                     98
 #define BRCMF_C_GET_CURR_RATESET                114
 #define BRCMF_C_GET_AP                          117
 #define BRCMF_C_SET_AP                          118
+#define BRCMF_C_SET_SCB_AUTHORIZE               121
+#define BRCMF_C_SET_SCB_DEAUTHORIZE             122
 #define BRCMF_C_GET_RSSI                        127
 #define BRCMF_C_GET_WSEC                        133
 #define BRCMF_C_SET_WSEC                        134
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
index 50891c02c4c1..374920965108 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
@@ -112,6 +112,7 @@
 #define BRCMF_WOWL_MAXPATTERNS          8
 #define BRCMF_WOWL_MAXPATTERNSIZE       128
 
+#define BRCMF_COUNTRY_BUF_SZ            4
 
 /* join preference types for join_pref iovar */
 enum brcmf_join_pref_types {
@@ -525,4 +526,58 @@ struct brcmf_mbss_ssid_le {
         unsigned char SSID[32];
 };
 
+/**
+ * struct brcmf_fil_country_le - country configuration structure.
+ *
+ * @country_abbrev: null-terminated country code used in the country IE.
+ * @rev: revision specifier for ccode. on set, -1 indicates unspecified.
+ * @ccode: null-terminated built-in country code.
+ */
+struct brcmf_fil_country_le {
+        char country_abbrev[BRCMF_COUNTRY_BUF_SZ];
+        __le32 rev;
+        char ccode[BRCMF_COUNTRY_BUF_SZ];
+};
+
+/**
+ * struct brcmf_rev_info_le - device revision info.
+ *
+ * @vendorid: PCI vendor id.
+ * @deviceid: device id of chip.
+ * @radiorev: radio revision.
+ * @chiprev: chip revision.
+ * @corerev: core revision.
+ * @boardid: board identifier (usu. PCI sub-device id).
+ * @boardvendor: board vendor (usu. PCI sub-vendor id).
+ * @boardrev: board revision.
+ * @driverrev: driver version.
+ * @ucoderev: microcode version.
+ * @bus: bus type.
+ * @chipnum: chip number.
+ * @phytype: phy type.
+ * @phyrev: phy revision.
+ * @anarev: anacore rev.
+ * @chippkg: chip package info.
+ * @nvramrev: nvram revision number.
+ */
+struct brcmf_rev_info_le {
+        __le32 vendorid;
+        __le32 deviceid;
+        __le32 radiorev;
+        __le32 chiprev;
+        __le32 corerev;
+        __le32 boardid;
+        __le32 boardvendor;
+        __le32 boardrev;
+        __le32 driverrev;
+        __le32 ucoderev;
+        __le32 bus;
+        __le32 chipnum;
+        __le32 phytype;
+        __le32 phyrev;
+        __le32 anarev;
+        __le32 chippkg;
+        __le32 nvramrev;
+};
+
 #endif /* FWIL_TYPES_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
index 456944a6a2db..6262612dec45 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
@@ -73,6 +73,8 @@
 #define BRCMF_MSGBUF_TX_FLUSH_CNT1              32
 #define BRCMF_MSGBUF_TX_FLUSH_CNT2              96
 
+#define BRCMF_MSGBUF_DELAY_TXWORKER_THRS        64
+#define BRCMF_MSGBUF_TRICKLE_TXWORKER_THRS      32
 
 struct msgbuf_common_hdr {
         u8                              msgtype;
@@ -583,7 +585,7 @@ brcmf_msgbuf_flowring_create_worker(struct brcmf_msgbuf *msgbuf,
         u32 flowid;
         void *dma_buf;
         u32 dma_sz;
-        long long address;
+        u64 address;
         int err;
 
         flowid = work->flowid;
@@ -620,7 +622,7 @@ brcmf_msgbuf_flowring_create_worker(struct brcmf_msgbuf *msgbuf,
                                            BRCMF_NROF_H2D_COMMON_MSGRINGS);
         memcpy(create->sa, work->sa, ETH_ALEN);
         memcpy(create->da, work->da, ETH_ALEN);
-        address = (long long)(long)msgbuf->flowring_dma_handle[flowid];
+        address = (u64)msgbuf->flowring_dma_handle[flowid];
         create->flow_ring_addr.high_addr = cpu_to_le32(address >> 32);
         create->flow_ring_addr.low_addr = cpu_to_le32(address & 0xffffffff);
         create->max_items = cpu_to_le16(BRCMF_H2D_TXFLOWRING_MAX_ITEM);
@@ -698,7 +700,7 @@ static void brcmf_msgbuf_txflow(struct brcmf_msgbuf *msgbuf, u8 flowid)
         dma_addr_t physaddr;
         u32 pktid;
         struct msgbuf_tx_msghdr *tx_msghdr;
-        long long address;
+        u64 address;
 
         commonring = msgbuf->flowrings[flowid];
         if (!brcmf_commonring_write_available(commonring))
@@ -742,13 +744,14 @@ static void brcmf_msgbuf_txflow(struct brcmf_msgbuf *msgbuf, u8 flowid)
                 tx_msghdr->seg_cnt = 1;
                 memcpy(tx_msghdr->txhdr, skb->data, ETH_HLEN);
                 tx_msghdr->data_len = cpu_to_le16(skb->len - ETH_HLEN);
-                address = (long long)(long)physaddr;
+                address = (u64)physaddr;
                 tx_msghdr->data_buf_addr.high_addr = cpu_to_le32(address >> 32);
                 tx_msghdr->data_buf_addr.low_addr =
                         cpu_to_le32(address & 0xffffffff);
                 tx_msghdr->metadata_buf_len = 0;
                 tx_msghdr->metadata_buf_addr.high_addr = 0;
                 tx_msghdr->metadata_buf_addr.low_addr = 0;
+                atomic_inc(&commonring->outstanding_tx);
                 if (count >= BRCMF_MSGBUF_TX_FLUSH_CNT2) {
                         brcmf_commonring_write_complete(commonring);
                         count = 0;
@@ -773,10 +776,16 @@ static void brcmf_msgbuf_txflow_worker(struct work_struct *worker)
 }
 
 
-static int brcmf_msgbuf_schedule_txdata(struct brcmf_msgbuf *msgbuf, u32 flowid)
+static int brcmf_msgbuf_schedule_txdata(struct brcmf_msgbuf *msgbuf, u32 flowid,
+                                        bool force)
 {
+        struct brcmf_commonring *commonring;
+
         set_bit(flowid, msgbuf->flow_map);
-        queue_work(msgbuf->txflow_wq, &msgbuf->txflow_work);
+        commonring = msgbuf->flowrings[flowid];
+        if ((force) || (atomic_read(&commonring->outstanding_tx) <
+                        BRCMF_MSGBUF_DELAY_TXWORKER_THRS))
+                queue_work(msgbuf->txflow_wq, &msgbuf->txflow_work);
 
         return 0;
 }
@@ -797,7 +806,7 @@ static int brcmf_msgbuf_txdata(struct brcmf_pub *drvr, int ifidx,
                         return -ENOMEM;
         }
         brcmf_flowring_enqueue(flow, flowid, skb);
-        brcmf_msgbuf_schedule_txdata(msgbuf, flowid);
+        brcmf_msgbuf_schedule_txdata(msgbuf, flowid, false);
 
         return 0;
 }
@@ -854,6 +863,7 @@ brcmf_msgbuf_process_ioctl_complete(struct brcmf_msgbuf *msgbuf, void *buf)
 static void
 brcmf_msgbuf_process_txstatus(struct brcmf_msgbuf *msgbuf, void *buf)
 {
+        struct brcmf_commonring *commonring;
         struct msgbuf_tx_status *tx_status;
         u32 idx;
         struct sk_buff *skb;
@@ -871,6 +881,8 @@ brcmf_msgbuf_process_txstatus(struct brcmf_msgbuf *msgbuf, void *buf)
         }
 
         set_bit(flowid, msgbuf->txstatus_done_map);
+        commonring = msgbuf->flowrings[flowid];
+        atomic_dec(&commonring->outstanding_tx);
 
         brcmf_txfinalize(msgbuf->drvr, skb, tx_status->msg.ifidx, true);
 }
@@ -885,7 +897,7 @@ static u32 brcmf_msgbuf_rxbuf_data_post(struct brcmf_msgbuf *msgbuf, u32 count)
         u32 pktlen;
         dma_addr_t physaddr;
         struct msgbuf_rx_bufpost *rx_bufpost;
-        long long address;
+        u64 address;
         u32 pktid;
         u32 i;
 
@@ -894,7 +906,7 @@ static u32 brcmf_msgbuf_rxbuf_data_post(struct brcmf_msgbuf *msgbuf, u32 count)
                                                               count,
                                                               &alloced);
         if (!ret_ptr) {
-                brcmf_err("Failed to reserve space in commonring\n");
+                brcmf_dbg(MSGBUF, "Failed to reserve space in commonring\n");
                 return 0;
         }
 
@@ -921,7 +933,7 @@ static u32 brcmf_msgbuf_rxbuf_data_post(struct brcmf_msgbuf *msgbuf, u32 count)
                 }
 
                 if (msgbuf->rx_metadata_offset) {
-                        address = (long long)(long)physaddr;
+                        address = (u64)physaddr;
                         rx_bufpost->metadata_buf_len =
                                 cpu_to_le16(msgbuf->rx_metadata_offset);
                         rx_bufpost->metadata_buf_addr.high_addr =
@@ -936,7 +948,7 @@ static u32 brcmf_msgbuf_rxbuf_data_post(struct brcmf_msgbuf *msgbuf, u32 count)
                 rx_bufpost->msg.msgtype = MSGBUF_TYPE_RXBUF_POST;
                 rx_bufpost->msg.request_id = cpu_to_le32(pktid);
 
-                address = (long long)(long)physaddr;
+                address = (u64)physaddr;
                 rx_bufpost->data_buf_len = cpu_to_le16((u16)pktlen);
                 rx_bufpost->data_buf_addr.high_addr =
                         cpu_to_le32(address >> 32);
@@ -992,7 +1004,7 @@ brcmf_msgbuf_rxbuf_ctrl_post(struct brcmf_msgbuf *msgbuf, bool event_buf,
         u32 pktlen;
         dma_addr_t physaddr;
         struct msgbuf_rx_ioctl_resp_or_event *rx_bufpost;
-        long long address;
+        u64 address;
         u32 pktid;
         u32 i;
 
@@ -1035,7 +1047,7 @@ brcmf_msgbuf_rxbuf_ctrl_post(struct brcmf_msgbuf *msgbuf, bool event_buf,
                                 MSGBUF_TYPE_IOCTLRESP_BUF_POST;
                 rx_bufpost->msg.request_id = cpu_to_le32(pktid);
 
-                address = (long long)(long)physaddr;
+                address = (u64)physaddr;
                 rx_bufpost->host_buf_len = cpu_to_le16((u16)pktlen);
                 rx_bufpost->host_buf_addr.high_addr =
                         cpu_to_le32(address >> 32);
@@ -1181,7 +1193,7 @@ brcmf_msgbuf_process_flow_ring_create_response(struct brcmf_msgbuf *msgbuf,
 
         brcmf_flowring_open(msgbuf->flow, flowid);
 
-        brcmf_msgbuf_schedule_txdata(msgbuf, flowid);
+        brcmf_msgbuf_schedule_txdata(msgbuf, flowid, true);
 }
 
 
@@ -1280,8 +1292,10 @@ int brcmf_proto_msgbuf_rx_trigger(struct device *dev)
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
         struct brcmf_pub *drvr = bus_if->drvr;
         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
+        struct brcmf_commonring *commonring;
         void *buf;
         u32 flowid;
+        int qlen;
 
         buf = msgbuf->commonrings[BRCMF_D2H_MSGRING_RX_COMPLETE];
         brcmf_msgbuf_process_rx(msgbuf, buf);
@@ -1293,8 +1307,12 @@ int brcmf_proto_msgbuf_rx_trigger(struct device *dev)
         for_each_set_bit(flowid, msgbuf->txstatus_done_map,
                          msgbuf->nrof_flowrings) {
                 clear_bit(flowid, msgbuf->txstatus_done_map);
-                if (brcmf_flowring_qlen(msgbuf->flow, flowid))
-                        brcmf_msgbuf_schedule_txdata(msgbuf, flowid);
+                commonring = msgbuf->flowrings[flowid];
+                qlen = brcmf_flowring_qlen(msgbuf->flow, flowid);
+                if ((qlen > BRCMF_MSGBUF_TRICKLE_TXWORKER_THRS) ||
+                    ((qlen) && (atomic_read(&commonring->outstanding_tx) <
+                                BRCMF_MSGBUF_TRICKLE_TXWORKER_THRS)))
+                        brcmf_msgbuf_schedule_txdata(msgbuf, flowid, true);
         }
 
         return 0;
@@ -1348,7 +1366,7 @@ int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)
 {
         struct brcmf_bus_msgbuf *if_msgbuf;
         struct brcmf_msgbuf *msgbuf;
-        long long address;
+        u64 address;
         u32 count;
 
         if_msgbuf = drvr->bus_if->msgbuf;
@@ -1379,7 +1397,7 @@ int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)
                                              GFP_KERNEL);
         if (!msgbuf->ioctbuf)
                 goto fail;
-        address = (long long)(long)msgbuf->ioctbuf_handle;
+        address = (u64)msgbuf->ioctbuf_handle;
         msgbuf->ioctbuf_phys_hi = address >> 32;
         msgbuf->ioctbuf_phys_lo = address & 0xffffffff;
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
index 905991fdb7b1..61c053a729be 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
@@ -959,14 +959,14 @@ brcmf_pcie_init_dmabuffer_for_device(struct brcmf_pciedev_info *devinfo,
                                      dma_addr_t *dma_handle)
 {
         void *ring;
-        long long address;
+        u64 address;
 
         ring = dma_alloc_coherent(&devinfo->pdev->dev, size, dma_handle,
                                   GFP_KERNEL);
         if (!ring)
                 return NULL;
 
-        address = (long long)(long)*dma_handle;
+        address = (u64)*dma_handle;
         brcmf_pcie_write_tcm32(devinfo, tcm_dma_phys_addr,
                                address & 0xffffffff);
         brcmf_pcie_write_tcm32(devinfo, tcm_dma_phys_addr + 4, address >> 32);
@@ -1166,7 +1166,7 @@ brcmf_pcie_release_scratchbuffers(struct brcmf_pciedev_info *devinfo)
 
 static int brcmf_pcie_init_scratchbuffers(struct brcmf_pciedev_info *devinfo)
 {
-        long long address;
+        u64 address;
         u32 addr;
 
         devinfo->shared.scratch = dma_alloc_coherent(&devinfo->pdev->dev,
@@ -1180,7 +1180,7 @@ static int brcmf_pcie_init_scratchbuffers(struct brcmf_pciedev_info *devinfo)
 
         addr = devinfo->shared.tcm_base_address +
                BRCMF_SHARED_DMA_SCRATCH_ADDR_OFFSET;
-        address = (long long)(long)devinfo->shared.scratch_dmahandle;
+        address = (u64)devinfo->shared.scratch_dmahandle;
         brcmf_pcie_write_tcm32(devinfo, addr, address & 0xffffffff);
         brcmf_pcie_write_tcm32(devinfo, addr + 4, address >> 32);
         addr = devinfo->shared.tcm_base_address +
@@ -1198,7 +1198,7 @@ static int brcmf_pcie_init_scratchbuffers(struct brcmf_pciedev_info *devinfo)
 
         addr = devinfo->shared.tcm_base_address +
                BRCMF_SHARED_DMA_RINGUPD_ADDR_OFFSET;
-        address = (long long)(long)devinfo->shared.ringupd_dmahandle;
+        address = (u64)devinfo->shared.ringupd_dmahandle;
         brcmf_pcie_write_tcm32(devinfo, addr, address & 0xffffffff);
         brcmf_pcie_write_tcm32(devinfo, addr + 4, address >> 32);
         addr = devinfo->shared.tcm_base_address +
@@ -1828,7 +1828,7 @@ static int brcmf_pcie_resume(struct pci_dev *pdev)
                                 goto cleanup;
                         brcmf_dbg(PCIE, "Hot resume, continue....\n");
                         brcmf_pcie_select_core(devinfo, BCMA_CORE_PCIE2);
-                        brcmf_bus_change_state(bus, BRCMF_BUS_DATA);
+                        brcmf_bus_change_state(bus, BRCMF_BUS_UP);
                         brcmf_pcie_intr_enable(devinfo);
                         return 0;
                 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
index 0b0d51a61060..faec35c899ec 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
@@ -44,7 +44,8 @@
 #include "chip.h"
 #include "firmware.h"
 
-#define DCMD_RESP_TIMEOUT  2000 /* In milli second */
+#define DCMD_RESP_TIMEOUT       2000    /* In milli second */
+#define CTL_DONE_TIMEOUT        2000    /* In milli second */
 
 #ifdef DEBUG
 
@@ -495,9 +496,9 @@ struct brcmf_sdio {
         u8 *ctrl_frame_buf;
         u16 ctrl_frame_len;
         bool ctrl_frame_stat;
+        int ctrl_frame_err;
 
         spinlock_t txq_lock;            /* protect bus->txq */
-        struct semaphore tx_seq_lock;   /* protect bus->tx_seq */
         wait_queue_head_t ctrl_wait;
         wait_queue_head_t dcmd_resp_wait;
 
@@ -514,7 +515,6 @@ struct brcmf_sdio {
         bool txoff;             /* Transmit flow-controlled */
         struct brcmf_sdio_count sdcnt;
         bool sr_enabled; /* SaveRestore enabled */
-        bool sleeping; /* SDIO bus sleeping */
 
         u8 tx_hdrlen;           /* sdio bus header length for tx packet */
         bool txglom;            /* host tx glomming enable flag */
@@ -608,6 +608,8 @@ static const struct sdiod_drive_str sdiod_drvstr_tab2_3v3[] = {
 #define BCM4330_NVRAM_NAME              "brcm/brcmfmac4330-sdio.txt"
 #define BCM4334_FIRMWARE_NAME           "brcm/brcmfmac4334-sdio.bin"
 #define BCM4334_NVRAM_NAME              "brcm/brcmfmac4334-sdio.txt"
+#define BCM43340_FIRMWARE_NAME          "brcm/brcmfmac43340-sdio.bin"
+#define BCM43340_NVRAM_NAME             "brcm/brcmfmac43340-sdio.txt"
 #define BCM4335_FIRMWARE_NAME           "brcm/brcmfmac4335-sdio.bin"
 #define BCM4335_NVRAM_NAME              "brcm/brcmfmac4335-sdio.txt"
 #define BCM43362_FIRMWARE_NAME          "brcm/brcmfmac43362-sdio.bin"
@@ -629,6 +631,8 @@ MODULE_FIRMWARE(BCM4330_FIRMWARE_NAME);
 MODULE_FIRMWARE(BCM4330_NVRAM_NAME);
 MODULE_FIRMWARE(BCM4334_FIRMWARE_NAME);
 MODULE_FIRMWARE(BCM4334_NVRAM_NAME);
+MODULE_FIRMWARE(BCM43340_FIRMWARE_NAME);
+MODULE_FIRMWARE(BCM43340_NVRAM_NAME);
 MODULE_FIRMWARE(BCM4335_FIRMWARE_NAME);
 MODULE_FIRMWARE(BCM4335_NVRAM_NAME);
 MODULE_FIRMWARE(BCM43362_FIRMWARE_NAME);
@@ -660,6 +664,7 @@ static const struct brcmf_firmware_names brcmf_fwname_data[] = {
         { BRCM_CC_4329_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4329) },
         { BRCM_CC_4330_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4330) },
         { BRCM_CC_4334_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4334) },
+        { BRCM_CC_43340_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM43340) },
         { BRCM_CC_4335_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4335) },
         { BRCM_CC_43362_CHIP_ID, 0xFFFFFFFE, BRCMF_FIRMWARE_NVRAM(BCM43362) },
         { BRCM_CC_4339_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4339) },
@@ -1008,12 +1013,12 @@ brcmf_sdio_bus_sleep(struct brcmf_sdio *bus, bool sleep, bool pendok)
 
         brcmf_dbg(SDIO, "Enter: request %s currently %s\n",
                   (sleep ? "SLEEP" : "WAKE"),
-                  (bus->sleeping ? "SLEEP" : "WAKE"));
+                  (bus->sdiodev->sleeping ? "SLEEP" : "WAKE"));
 
         /* If SR is enabled control bus state with KSO */
         if (bus->sr_enabled) {
                 /* Done if we're already in the requested state */
-                if (sleep == bus->sleeping)
+                if (sleep == bus->sdiodev->sleeping)
                         goto end;
 
                 /* Going to sleep */
@@ -1045,12 +1050,7 @@ brcmf_sdio_bus_sleep(struct brcmf_sdio *bus, bool sleep, bool pendok)
                         bus->idlecount = 0;
                         err = brcmf_sdio_kso_control(bus, true);
                 }
-                if (!err) {
-                        /* Change state */
-                        bus->sleeping = sleep;
-                        brcmf_dbg(SDIO, "new state %s\n",
-                                  (sleep ? "SLEEP" : "WAKE"));
-                } else {
+                if (err) {
                         brcmf_err("error while changing bus sleep state %d\n",
                                   err);
                         goto done;
@@ -1065,6 +1065,11 @@ end:
         } else {
                 brcmf_sdio_clkctl(bus, CLK_AVAIL, pendok);
         }
+        bus->sdiodev->sleeping = sleep;
+        if (sleep)
+                wake_up(&bus->sdiodev->idle_wait);
+        brcmf_dbg(SDIO, "new state %s\n",
+                  (sleep ? "SLEEP" : "WAKE"));
 done:
         brcmf_dbg(SDIO, "Exit: err=%d\n", err);
         return err;
@@ -1904,7 +1909,7 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
         bus->rxpending = true;
 
         for (rd->seq_num = bus->rx_seq, rxleft = maxframes;
-             !bus->rxskip && rxleft && brcmf_bus_ready(bus->sdiodev->bus_if);
+             !bus->rxskip && rxleft && bus->sdiodev->state == BRCMF_STATE_DATA;
              rd->seq_num++, rxleft--) {
 
                 /* Handle glomming separately */
@@ -2371,8 +2376,6 @@ static uint brcmf_sdio_sendfromq(struct brcmf_sdio *bus, uint maxframes)
         /* Send frames until the limit or some other event */
         for (cnt = 0; (cnt < maxframes) && data_ok(bus);) {
                 pkt_num = 1;
-                if (down_interruptible(&bus->tx_seq_lock))
-                        return cnt;
                 if (bus->txglom)
                         pkt_num = min_t(u8, bus->tx_max - bus->tx_seq,
                                         bus->sdiodev->txglomsz);
@@ -2388,13 +2391,10 @@ static uint brcmf_sdio_sendfromq(struct brcmf_sdio *bus, uint maxframes)
                         __skb_queue_tail(&pktq, pkt);
                 }
                 spin_unlock_bh(&bus->txq_lock);
-                if (i == 0) {
-                        up(&bus->tx_seq_lock);
+                if (i == 0)
                         break;
-                }
 
                 ret = brcmf_sdio_txpkt(bus, &pktq, SDPCM_DATA_CHANNEL);
-                up(&bus->tx_seq_lock);
 
                 cnt += i;
 
@@ -2415,7 +2415,7 @@ static uint brcmf_sdio_sendfromq(struct brcmf_sdio *bus, uint maxframes)
         }
 
         /* Deflow-control stack if needed */
-        if ((bus->sdiodev->bus_if->state == BRCMF_BUS_DATA) &&
+        if ((bus->sdiodev->state == BRCMF_STATE_DATA) &&
             bus->txoff && (pktq_len(&bus->txq) < TXLOW)) {
                 bus->txoff = false;
                 brcmf_txflowblock(bus->sdiodev->dev, false);
@@ -2503,7 +2503,7 @@ static void brcmf_sdio_bus_stop(struct device *dev)
                 bus->watchdog_tsk = NULL;
         }
 
-        if (bus_if->state == BRCMF_BUS_DOWN) {
+        if (sdiodev->state != BRCMF_STATE_NOMEDIUM) {
                 sdio_claim_host(sdiodev->func[1]);
 
                 /* Enable clock for device interrupts */
@@ -2538,8 +2538,7 @@ static void brcmf_sdio_bus_stop(struct device *dev)
         brcmu_pktq_flush(&bus->txq, true, NULL, NULL);
 
         /* Clear any held glomming stuff */
-        if (bus->glomd)
-                brcmu_pkt_buf_free_skb(bus->glomd);
+        brcmu_pkt_buf_free_skb(bus->glomd);
         brcmf_sdio_free_glom(bus);
 
         /* Clear rx control and wake any waiters */
@@ -2604,6 +2603,21 @@ static int brcmf_sdio_intr_rstatus(struct brcmf_sdio *bus)
         return ret;
 }
 
+static int brcmf_sdio_pm_resume_wait(struct brcmf_sdio_dev *sdiodev)
+{
+#ifdef CONFIG_PM_SLEEP
+        int retry;
+
+        /* Wait for possible resume to complete */
+        retry = 0;
+        while ((atomic_read(&sdiodev->suspend)) && (retry++ != 50))
+                msleep(20);
+        if (atomic_read(&sdiodev->suspend))
+                return -EIO;
+#endif
+        return 0;
+}
+
 static void brcmf_sdio_dpc(struct brcmf_sdio *bus)
 {
         u32 newstatus = 0;
@@ -2614,6 +2628,9 @@ static void brcmf_sdio_dpc(struct brcmf_sdio *bus)
 
         brcmf_dbg(TRACE, "Enter\n");
 
+        if (brcmf_sdio_pm_resume_wait(bus->sdiodev))
+                return;
+
         sdio_claim_host(bus->sdiodev->func[1]);
 
         /* If waiting for HTAVAIL, check status */
@@ -2720,17 +2737,14 @@ static void brcmf_sdio_dpc(struct brcmf_sdio *bus)
         brcmf_sdio_clrintr(bus);
 
         if (bus->ctrl_frame_stat && (bus->clkstate == CLK_AVAIL) &&
-            (down_interruptible(&bus->tx_seq_lock) == 0)) {
-                if (data_ok(bus)) {
-                        sdio_claim_host(bus->sdiodev->func[1]);
-                        err = brcmf_sdio_tx_ctrlframe(bus,  bus->ctrl_frame_buf,
-                                                      bus->ctrl_frame_len);
-                        sdio_release_host(bus->sdiodev->func[1]);
-
-                        bus->ctrl_frame_stat = false;
-                        brcmf_sdio_wait_event_wakeup(bus);
-                }
-                up(&bus->tx_seq_lock);
+            data_ok(bus)) {
+                sdio_claim_host(bus->sdiodev->func[1]);
+                err = brcmf_sdio_tx_ctrlframe(bus,  bus->ctrl_frame_buf,
+                                              bus->ctrl_frame_len);
+                sdio_release_host(bus->sdiodev->func[1]);
+                bus->ctrl_frame_err = err;
+                bus->ctrl_frame_stat = false;
+                brcmf_sdio_wait_event_wakeup(bus);
         }
         /* Send queued frames (limit 1 if rx may still be pending) */
         if ((bus->clkstate == CLK_AVAIL) && !atomic_read(&bus->fcstate) &&
@@ -2741,7 +2755,7 @@ static void brcmf_sdio_dpc(struct brcmf_sdio *bus)
                 brcmf_sdio_sendfromq(bus, framecnt);
         }
 
-        if (!brcmf_bus_ready(bus->sdiodev->bus_if) || (err != 0)) {
+        if ((bus->sdiodev->state != BRCMF_STATE_DATA) || (err != 0)) {
                 brcmf_err("failed backplane access over SDIO, halting operation\n");
                 atomic_set(&bus->intstatus, 0);
         } else if (atomic_read(&bus->intstatus) ||
@@ -2942,43 +2956,30 @@ brcmf_sdio_bus_txctl(struct device *dev, unsigned char *msg, uint msglen)
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
         struct brcmf_sdio *bus = sdiodev->bus;
-        int ret = -1;
+        int ret;
 
         brcmf_dbg(TRACE, "Enter\n");
 
-        if (down_interruptible(&bus->tx_seq_lock))
-                return -EINTR;
-
-        if (!data_ok(bus)) {
-                brcmf_dbg(INFO, "No bus credit bus->tx_max %d, bus->tx_seq %d\n",
-                          bus->tx_max, bus->tx_seq);
-                up(&bus->tx_seq_lock);
-                /* Send from dpc */
-                bus->ctrl_frame_buf = msg;
-                bus->ctrl_frame_len = msglen;
-                bus->ctrl_frame_stat = true;
-
-                wait_event_interruptible_timeout(bus->ctrl_wait,
-                                                 !bus->ctrl_frame_stat,
-                                                 msecs_to_jiffies(2000));
-
-                if (!bus->ctrl_frame_stat) {
-                        brcmf_dbg(SDIO, "ctrl_frame_stat == false\n");
-                        ret = 0;
-                } else {
-                        brcmf_dbg(SDIO, "ctrl_frame_stat == true\n");
-                        bus->ctrl_frame_stat = false;
-                        if (down_interruptible(&bus->tx_seq_lock))
-                                return -EINTR;
-                        ret = -1;
-                }
+        /* Send from dpc */
+        bus->ctrl_frame_buf = msg;
+        bus->ctrl_frame_len = msglen;
+        bus->ctrl_frame_stat = true;
+        if (atomic_read(&bus->dpc_tskcnt) == 0) {
+                atomic_inc(&bus->dpc_tskcnt);
+                queue_work(bus->brcmf_wq, &bus->datawork);
         }
-        if (ret == -1) {
-                sdio_claim_host(bus->sdiodev->func[1]);
-                brcmf_sdio_bus_sleep(bus, false, false);
-                ret = brcmf_sdio_tx_ctrlframe(bus, msg, msglen);
-                sdio_release_host(bus->sdiodev->func[1]);
-                up(&bus->tx_seq_lock);
+
+        wait_event_interruptible_timeout(bus->ctrl_wait, !bus->ctrl_frame_stat,
+                                         msecs_to_jiffies(CTL_DONE_TIMEOUT));
+
+        if (!bus->ctrl_frame_stat) {
+                brcmf_dbg(SDIO, "ctrl_frame complete, err=%d\n",
+                          bus->ctrl_frame_err);
+                ret = bus->ctrl_frame_err;
+        } else {
+                brcmf_dbg(SDIO, "ctrl_frame timeout\n");
+                bus->ctrl_frame_stat = false;
+                ret = -ETIMEDOUT;
         }
 
         if (ret)
@@ -2986,7 +2987,7 @@ brcmf_sdio_bus_txctl(struct device *dev, unsigned char *msg, uint msglen)
         else
                 bus->sdcnt.tx_ctlpkts++;
 
-        return ret ? -EIO : 0;
+        return ret;
 }
 
 #ifdef DEBUG
@@ -3409,8 +3410,8 @@ static int brcmf_sdio_download_firmware(struct brcmf_sdio *bus,
                 goto err;
         }
 
-        /* Allow HT Clock now that the ARM is running. */
-        brcmf_bus_change_state(bus->sdiodev->bus_if, BRCMF_BUS_LOAD);
+        /* Allow full data communication using DPC from now on. */
+        bus->sdiodev->state = BRCMF_STATE_DATA;
         bcmerror = 0;
 
 err:
@@ -3556,7 +3557,7 @@ void brcmf_sdio_isr(struct brcmf_sdio *bus)
                 return;
         }
 
-        if (!brcmf_bus_ready(bus->sdiodev->bus_if)) {
+        if (bus->sdiodev->state != BRCMF_STATE_DATA) {
                 brcmf_err("bus is down. we have nothing to do\n");
                 return;
         }
@@ -3579,10 +3580,6 @@ void brcmf_sdio_isr(struct brcmf_sdio *bus)
 
 static bool brcmf_sdio_bus_watchdog(struct brcmf_sdio *bus)
 {
-#ifdef DEBUG
-        struct brcmf_bus *bus_if = dev_get_drvdata(bus->sdiodev->dev);
-#endif  /* DEBUG */
-
         brcmf_dbg(TIMER, "Enter\n");
 
         /* Poll period: check device if appropriate. */
@@ -3626,7 +3623,7 @@ static bool brcmf_sdio_bus_watchdog(struct brcmf_sdio *bus)
         }
 #ifdef DEBUG
         /* Poll for console output periodically */
-        if (bus_if && bus_if->state == BRCMF_BUS_DATA &&
+        if (bus->sdiodev->state == BRCMF_STATE_DATA &&
             bus->console_interval != 0) {
                 bus->console.count += BRCMF_WD_POLL_MS;
                 if (bus->console.count >= bus->console_interval) {
@@ -3811,7 +3808,7 @@ static u32 brcmf_sdio_buscore_read32(void *ctx, u32 addr)
         u32 val, rev;
 
         val = brcmf_sdiod_regrl(sdiodev, addr, NULL);
-        if (sdiodev->func[0]->device == BRCM_SDIO_4335_4339_DEVICE_ID &&
+        if (sdiodev->func[0]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339 &&
             addr == CORE_CC_REG(SI_ENUM_BASE, chipid)) {
                 rev = (val & CID_REV_MASK) >> CID_REV_SHIFT;
                 if (rev >= 2) {
@@ -3867,11 +3864,6 @@ brcmf_sdio_probe_attach(struct brcmf_sdio *bus)
                 goto fail;
         }
 
-        /* SDIO register access works so moving
-         * state from UNKNOWN to DOWN.
-         */
-        brcmf_bus_change_state(bus->sdiodev->bus_if, BRCMF_BUS_DOWN);
-
         bus->ci = brcmf_chip_attach(bus->sdiodev, &brcmf_sdio_buscore_ops);
         if (IS_ERR(bus->ci)) {
                 brcmf_err("brcmf_chip_attach failed!\n");
@@ -4005,18 +3997,16 @@ static void brcmf_sdio_firmware_callback(struct device *dev,
 
         brcmf_dbg(TRACE, "Enter: dev=%s\n", dev_name(dev));
 
-        /* try to download image and nvram to the dongle */
-        if (bus_if->state == BRCMF_BUS_DOWN) {
-                bus->alp_only = true;
-                err = brcmf_sdio_download_firmware(bus, code, nvram, nvram_len);
-                if (err)
-                        goto fail;
-                bus->alp_only = false;
-        }
-
         if (!bus_if->drvr)
                 return;
 
+        /* try to download image and nvram to the dongle */
+        bus->alp_only = true;
+        err = brcmf_sdio_download_firmware(bus, code, nvram, nvram_len);
+        if (err)
+                goto fail;
+        bus->alp_only = false;
+
         /* Start the watchdog timer */
         bus->sdcnt.tickcnt = 0;
         brcmf_sdio_wd_timer(bus, BRCMF_WD_POLL_MS);
@@ -4142,7 +4132,6 @@ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
 
         spin_lock_init(&bus->rxctl_lock);
         spin_lock_init(&bus->txq_lock);
-        sema_init(&bus->tx_seq_lock, 1);
         init_waitqueue_head(&bus->ctrl_wait);
         init_waitqueue_head(&bus->dcmd_resp_wait);
 
@@ -4213,7 +4202,6 @@ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
         bus->idleclock = BRCMF_IDLE_ACTIVE;
 
         /* SR state */
-        bus->sleeping = false;
         bus->sr_enabled = false;
 
         brcmf_sdio_debugfs_create(bus);
@@ -4254,7 +4242,7 @@ void brcmf_sdio_remove(struct brcmf_sdio *bus)
                         destroy_workqueue(bus->brcmf_wq);
 
                 if (bus->ci) {
-                        if (bus->sdiodev->bus_if->state == BRCMF_BUS_DOWN) {
+                        if (bus->sdiodev->state != BRCMF_STATE_NOMEDIUM) {
                                 sdio_claim_host(bus->sdiodev->func[1]);
                                 brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
                                 /* Leave the device in state where it is
@@ -4289,7 +4277,7 @@ void brcmf_sdio_wd_timer(struct brcmf_sdio *bus, uint wdtick)
         }
 
         /* don't start the wd until fw is loaded */
-        if (bus->sdiodev->bus_if->state != BRCMF_BUS_DATA)
+        if (bus->sdiodev->state != BRCMF_STATE_DATA)
                 return;
 
         if (wdtick) {
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio.h b/drivers/net/wireless/brcm80211/brcmfmac/sdio.h
index 8eb42620129c..ec2586a8425c 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.h
@@ -155,6 +155,13 @@
 /* watchdog polling interval in ms */
 #define BRCMF_WD_POLL_MS        10
 
+/* The state of the bus */
+enum brcmf_sdio_state {
+        BRCMF_STATE_DOWN,       /* Device available, still initialising */
+        BRCMF_STATE_DATA,       /* Ready for data transfers, DPC enabled */
+        BRCMF_STATE_NOMEDIUM    /* No medium access to dongle possible */
+};
+
 struct brcmf_sdreg {
         int func;
         int offset;
@@ -169,8 +176,8 @@ struct brcmf_sdio_dev {
         u32 sbwad;                      /* Save backplane window address */
         struct brcmf_sdio *bus;
         atomic_t suspend;               /* suspend flag */
-        wait_queue_head_t request_word_wait;
-        wait_queue_head_t request_buffer_wait;
+        bool sleeping;
+        wait_queue_head_t idle_wait;
         struct device *dev;
         struct brcmf_bus *bus_if;
         struct brcmfmac_sdio_platform_data *pdata;
@@ -187,6 +194,7 @@ struct brcmf_sdio_dev {
         char fw_name[BRCMF_FW_PATH_LEN + BRCMF_FW_NAME_LEN];
         char nvram_name[BRCMF_FW_PATH_LEN + BRCMF_FW_NAME_LEN];
         bool wowl_enabled;
+        enum brcmf_sdio_state state;
 };
 
 /* sdio core registers */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index 4572defc280f..5df6aa72cc2d 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -421,7 +421,7 @@ fail:
         brcmf_err("fail!\n");
         while (!list_empty(q)) {
                 req = list_entry(q->next, struct brcmf_usbreq, list);
-                if (req && req->urb)
+                if (req)
                         usb_free_urb(req->urb);
                 list_del(q->next);
         }
@@ -576,7 +576,7 @@ brcmf_usb_state_change(struct brcmf_usbdev_info *devinfo, int state)
                 brcmf_bus_change_state(bcmf_bus, BRCMF_BUS_DOWN);
         } else if (state == BRCMFMAC_USB_STATE_UP) {
                 brcmf_dbg(USB, "DBUS is up\n");
-                brcmf_bus_change_state(bcmf_bus, BRCMF_BUS_DATA);
+                brcmf_bus_change_state(bcmf_bus, BRCMF_BUS_UP);
         } else {
                 brcmf_dbg(USB, "DBUS current state=%d\n", state);
         }
@@ -1263,6 +1263,8 @@ static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo)
                 ret = brcmf_usb_bus_setup(devinfo);
                 if (ret)
                         goto fail;
+                /* we are done */
+                return 0;
         }
         bus->chip = bus_pub->devid;
         bus->chiprev = bus_pub->chiprev;
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/debug.c b/drivers/net/wireless/brcm80211/brcmsmac/debug.c
index c9a8b9360ab1..7a1fbb2e3a71 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/debug.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/debug.c
@@ -78,7 +78,7 @@ int brcms_debugfs_hardware_read(struct seq_file *s, void *data)
         struct brcms_hardware *hw = drvr->wlc->hw;
         struct bcma_device *core = hw->d11core;
         struct bcma_bus *bus = core->bus;
-        char boardrev[10];
+        char boardrev[BRCMU_BOARDREV_LEN];
 
         seq_printf(s, "chipnum 0x%x\n"
                    "chiprev 0x%x\n"
diff --git a/drivers/net/wireless/brcm80211/brcmutil/utils.c b/drivers/net/wireless/brcm80211/brcmutil/utils.c
index 906e89ddf319..0543607002fd 100644
--- a/drivers/net/wireless/brcm80211/brcmutil/utils.c
+++ b/drivers/net/wireless/brcm80211/brcmutil/utils.c
@@ -267,15 +267,43 @@ char *brcmu_boardrev_str(u32 brev, char *buf)
         char c;
 
         if (brev < 0x100) {
-                snprintf(buf, 8, "%d.%d", (brev & 0xf0) >> 4, brev & 0xf);
+                snprintf(buf, BRCMU_BOARDREV_LEN, "%d.%d",
+                         (brev & 0xf0) >> 4, brev & 0xf);
         } else {
                 c = (brev & 0xf000) == 0x1000 ? 'P' : 'A';
-                snprintf(buf, 8, "%c%03x", c, brev & 0xfff);
+                snprintf(buf, BRCMU_BOARDREV_LEN, "%c%03x", c, brev & 0xfff);
         }
         return buf;
 }
 EXPORT_SYMBOL(brcmu_boardrev_str);
 
+char *brcmu_dotrev_str(u32 dotrev, char *buf)
+{
+        u8 dotval[4];
+
+        if (!dotrev) {
+                snprintf(buf, BRCMU_DOTREV_LEN, "unknown");
+                return buf;
+        }
+        dotval[0] = (dotrev >> 24) & 0xFF;
+        dotval[1] = (dotrev >> 16) & 0xFF;
+        dotval[2] = (dotrev >> 8) & 0xFF;
+        dotval[3] = dotrev & 0xFF;
+
+        if (dotval[3])
+                snprintf(buf, BRCMU_DOTREV_LEN, "%d.%d.%d.%d", dotval[0],
+                        dotval[1], dotval[2], dotval[3]);
+        else if (dotval[2])
+                snprintf(buf, BRCMU_DOTREV_LEN, "%d.%d.%d", dotval[0],
+                        dotval[1], dotval[2]);
+        else
+                snprintf(buf, BRCMU_DOTREV_LEN, "%d.%d", dotval[0],
+                        dotval[1]);
+
+        return buf;
+}
+EXPORT_SYMBOL(brcmu_dotrev_str);
+
 #if defined(DEBUG)
 /* pretty hex print a pkt buffer chain */
 void brcmu_prpkt(const char *msg, struct sk_buff *p0)
diff --git a/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h b/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
index 6996fcc144cf..2124a17d0bfd 100644
--- a/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
+++ b/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
@@ -22,7 +22,6 @@
 
 #define BRCM_USB_VENDOR_ID_BROADCOM     0x0a5c
 #define BRCM_PCIE_VENDOR_ID_BROADCOM    PCI_VENDOR_ID_BROADCOM
-#define BRCM_SDIO_VENDOR_ID_BROADCOM    SDIO_VENDOR_ID_BROADCOM
 
 /* Chipcommon Core Chip IDs */
 #define BRCM_CC_43143_CHIP_ID           43143
@@ -34,6 +33,7 @@
 #define BRCM_CC_4329_CHIP_ID            0x4329
 #define BRCM_CC_4330_CHIP_ID            0x4330
 #define BRCM_CC_4334_CHIP_ID            0x4334
+#define BRCM_CC_43340_CHIP_ID           43340
 #define BRCM_CC_43362_CHIP_ID           43362
 #define BRCM_CC_4335_CHIP_ID            0x4335
 #define BRCM_CC_4339_CHIP_ID            0x4339
@@ -45,16 +45,6 @@
 #define BRCM_CC_43570_CHIP_ID           43570
 #define BRCM_CC_43602_CHIP_ID           43602
 
-/* SDIO Device IDs */
-#define BRCM_SDIO_43143_DEVICE_ID       BRCM_CC_43143_CHIP_ID
-#define BRCM_SDIO_43241_DEVICE_ID       BRCM_CC_43241_CHIP_ID
-#define BRCM_SDIO_4329_DEVICE_ID        BRCM_CC_4329_CHIP_ID
-#define BRCM_SDIO_4330_DEVICE_ID        BRCM_CC_4330_CHIP_ID
-#define BRCM_SDIO_4334_DEVICE_ID        BRCM_CC_4334_CHIP_ID
-#define BRCM_SDIO_43362_DEVICE_ID       BRCM_CC_43362_CHIP_ID
-#define BRCM_SDIO_4335_4339_DEVICE_ID   BRCM_CC_4335_CHIP_ID
-#define BRCM_SDIO_4354_DEVICE_ID        BRCM_CC_4354_CHIP_ID
-
 /* USB Device IDs */
 #define BRCM_USB_43143_DEVICE_ID        0xbd1e
 #define BRCM_USB_43236_DEVICE_ID        0xbd17
diff --git a/drivers/net/wireless/brcm80211/include/brcmu_utils.h b/drivers/net/wireless/brcm80211/include/brcmu_utils.h
index a043e29f07e2..41969527b459 100644
--- a/drivers/net/wireless/brcm80211/include/brcmu_utils.h
+++ b/drivers/net/wireless/brcm80211/include/brcmu_utils.h
@@ -218,6 +218,10 @@ void brcmu_dbg_hex_dump(const void *data, size_t size, const char *fmt, ...)
 }
 #endif
 
+#define BRCMU_BOARDREV_LEN      8
+#define BRCMU_DOTREV_LEN        16
+
 char *brcmu_boardrev_str(u32 brev, char *buf);
+char *brcmu_dotrev_str(u32 dotrev, char *buf);
 
 #endif                          /* _BRCMU_UTILS_H_ */
diff --git a/drivers/net/wireless/cw1200/fwio.c b/drivers/net/wireless/cw1200/fwio.c
index 6f1b9aace8b3..30e7646d04af 100644
--- a/drivers/net/wireless/cw1200/fwio.c
+++ b/drivers/net/wireless/cw1200/fwio.c
@@ -66,25 +66,31 @@ static int cw1200_load_firmware_cw1200(struct cw1200_common *priv)
         do { \
                 ret = cw1200_apb_write_32(priv, CW1200_APB(reg), (val)); \
                 if (ret < 0) \
-                        goto error; \
+                        goto exit; \
+        } while (0)
+#define APB_WRITE2(reg, val) \
+        do { \
+                ret = cw1200_apb_write_32(priv, CW1200_APB(reg), (val)); \
+                if (ret < 0) \
+                        goto free_buffer; \
         } while (0)
 #define APB_READ(reg, val) \
         do { \
                 ret = cw1200_apb_read_32(priv, CW1200_APB(reg), &(val)); \
                 if (ret < 0) \
-                        goto error; \
+                        goto free_buffer; \
         } while (0)
 #define REG_WRITE(reg, val) \
         do { \
                 ret = cw1200_reg_write_32(priv, (reg), (val)); \
                 if (ret < 0) \
-                        goto error; \
+                        goto exit; \
         } while (0)
 #define REG_READ(reg, val) \
         do { \
                 ret = cw1200_reg_read_32(priv, (reg), &(val)); \
                 if (ret < 0) \
-                        goto error; \
+                        goto exit; \
         } while (0)
 
         switch (priv->hw_revision) {
@@ -142,14 +148,14 @@ static int cw1200_load_firmware_cw1200(struct cw1200_common *priv)
         ret = request_firmware(&firmware, fw_path, priv->pdev);
         if (ret) {
                 pr_err("Can't load firmware file %s.\n", fw_path);
-                goto error;
+                goto exit;
         }
 
         buf = kmalloc(DOWNLOAD_BLOCK_SIZE, GFP_KERNEL | GFP_DMA);
         if (!buf) {
                 pr_err("Can't allocate firmware load buffer.\n");
                 ret = -ENOMEM;
-                goto error;
+                goto firmware_release;
         }
 
         /* Check if the bootloader is ready */
@@ -163,7 +169,7 @@ static int cw1200_load_firmware_cw1200(struct cw1200_common *priv)
         if (val32 != DOWNLOAD_I_AM_HERE) {
                 pr_err("Bootloader is not ready.\n");
                 ret = -ETIMEDOUT;
-                goto error;
+                goto free_buffer;
         }
 
         /* Calculcate number of download blocks */
@@ -171,7 +177,7 @@ static int cw1200_load_firmware_cw1200(struct cw1200_common *priv)
 
         /* Updating the length in Download Ctrl Area */
         val32 = firmware->size; /* Explicit cast from size_t to u32 */
-        APB_WRITE(DOWNLOAD_IMAGE_SIZE_REG, val32);
+        APB_WRITE2(DOWNLOAD_IMAGE_SIZE_REG, val32);
 
         /* Firmware downloading loop */
         for (block = 0; block < num_blocks; block++) {
@@ -183,7 +189,7 @@ static int cw1200_load_firmware_cw1200(struct cw1200_common *priv)
                 if (val32 != DOWNLOAD_PENDING) {
                         pr_err("Bootloader reported error %d.\n", val32);
                         ret = -EIO;
-                        goto error;
+                        goto free_buffer;
                 }
 
                 /* loop until put - get <= 24K */
@@ -198,7 +204,7 @@ static int cw1200_load_firmware_cw1200(struct cw1200_common *priv)
                 if ((put - get) > (DOWNLOAD_FIFO_SIZE - DOWNLOAD_BLOCK_SIZE)) {
                         pr_err("Timeout waiting for FIFO.\n");
                         ret = -ETIMEDOUT;
-                        goto error;
+                        goto free_buffer;
                 }
 
                 /* calculate the block size */
@@ -220,12 +226,12 @@ static int cw1200_load_firmware_cw1200(struct cw1200_common *priv)
                 if (ret < 0) {
                         pr_err("Can't write firmware block @ %d!\n",
                                put & (DOWNLOAD_FIFO_SIZE - 1));
-                        goto error;
+                        goto free_buffer;
                 }
 
                 /* update the put register */
                 put += block_size;
-                APB_WRITE(DOWNLOAD_PUT_REG, put);
+                APB_WRITE2(DOWNLOAD_PUT_REG, put);
         } /* End of firmware download loop */
 
         /* Wait for the download completion */
@@ -238,19 +244,21 @@ static int cw1200_load_firmware_cw1200(struct cw1200_common *priv)
         if (val32 != DOWNLOAD_SUCCESS) {
                 pr_err("Wait for download completion failed: 0x%.8X\n", val32);
                 ret = -ETIMEDOUT;
-                goto error;
+                goto free_buffer;
         } else {
                 pr_info("Firmware download completed.\n");
                 ret = 0;
         }
 
-error:
+free_buffer:
         kfree(buf);
-        if (firmware)
-                release_firmware(firmware);
+firmware_release:
+        release_firmware(firmware);
+exit:
         return ret;
 
 #undef APB_WRITE
+#undef APB_WRITE2
 #undef APB_READ
 #undef REG_WRITE
 #undef REG_READ
diff --git a/drivers/net/wireless/cw1200/main.c b/drivers/net/wireless/cw1200/main.c
index 3e78cc3ccb78..3689dbbd10bd 100644
--- a/drivers/net/wireless/cw1200/main.c
+++ b/drivers/net/wireless/cw1200/main.c
@@ -282,7 +282,6 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr,
                     IEEE80211_HW_SUPPORTS_PS |
                     IEEE80211_HW_SUPPORTS_DYNAMIC_PS |
                     IEEE80211_HW_REPORTS_TX_ACK_STATUS |
-                    IEEE80211_HW_SUPPORTS_UAPSD |
                     IEEE80211_HW_CONNECTION_MONITOR |
                     IEEE80211_HW_AMPDU_AGGREGATION |
                     IEEE80211_HW_TX_AMPDU_SETUP_IN_HW |
@@ -374,9 +373,8 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr,
         INIT_WORK(&priv->update_filtering_work, cw1200_update_filtering_work);
         INIT_WORK(&priv->set_beacon_wakeup_period_work,
                   cw1200_set_beacon_wakeup_period_work);
-        init_timer(&priv->mcast_timeout);
-        priv->mcast_timeout.data = (unsigned long)priv;
-        priv->mcast_timeout.function = cw1200_mcast_timeout;
+        setup_timer(&priv->mcast_timeout, cw1200_mcast_timeout,
+                    (unsigned long)priv);
 
         if (cw1200_queue_stats_init(&priv->tx_queue_stats,
                                     CW1200_LINK_ID_MAX,
diff --git a/drivers/net/wireless/cw1200/pm.c b/drivers/net/wireless/cw1200/pm.c
index 6907c8fd4578..d2202ae92bdd 100644
--- a/drivers/net/wireless/cw1200/pm.c
+++ b/drivers/net/wireless/cw1200/pm.c
@@ -101,9 +101,8 @@ int cw1200_pm_init(struct cw1200_pm_state *pm,
 {
         spin_lock_init(&pm->lock);
 
-        init_timer(&pm->stay_awake);
-        pm->stay_awake.data = (unsigned long)pm;
-        pm->stay_awake.function = cw1200_pm_stay_awake_tmo;
+        setup_timer(&pm->stay_awake, cw1200_pm_stay_awake_tmo,
+                    (unsigned long)pm);
 
         return 0;
 }
diff --git a/drivers/net/wireless/cw1200/queue.c b/drivers/net/wireless/cw1200/queue.c
index 9c3925f58d79..0ba5ef9b3e7b 100644
--- a/drivers/net/wireless/cw1200/queue.c
+++ b/drivers/net/wireless/cw1200/queue.c
@@ -179,9 +179,7 @@ int cw1200_queue_init(struct cw1200_queue *queue,
         INIT_LIST_HEAD(&queue->pending);
         INIT_LIST_HEAD(&queue->free_pool);
         spin_lock_init(&queue->lock);
-        init_timer(&queue->gc);
-        queue->gc.data = (unsigned long)queue;
-        queue->gc.function = cw1200_queue_gc;
+        setup_timer(&queue->gc, cw1200_queue_gc, (unsigned long)queue);
 
         queue->pool = kzalloc(sizeof(struct cw1200_queue_item) * capacity,
                         GFP_KERNEL);
diff --git a/drivers/net/wireless/cw1200/scan.c b/drivers/net/wireless/cw1200/scan.c
index f2e276faca70..bff81b8d4164 100644
--- a/drivers/net/wireless/cw1200/scan.c
+++ b/drivers/net/wireless/cw1200/scan.c
@@ -39,9 +39,9 @@ static int cw1200_scan_start(struct cw1200_common *priv, struct wsm_scan *scan)
         cancel_delayed_work_sync(&priv->clear_recent_scan_work);
         atomic_set(&priv->scan.in_progress, 1);
         atomic_set(&priv->recent_scan, 1);
-        cw1200_pm_stay_awake(&priv->pm_state, tmo * HZ / 1000);
+        cw1200_pm_stay_awake(&priv->pm_state, msecs_to_jiffies(tmo));
         queue_delayed_work(priv->workqueue, &priv->scan.timeout,
-                           tmo * HZ / 1000);
+                           msecs_to_jiffies(tmo));
         ret = wsm_scan(priv, scan);
         if (ret) {
                 atomic_set(&priv->scan.in_progress, 0);
@@ -386,8 +386,8 @@ void cw1200_probe_work(struct work_struct *work)
         if (down_trylock(&priv->scan.lock)) {
                 /* Scan is already in progress. Requeue self. */
                 schedule();
-                queue_delayed_work(priv->workqueue,
-                                   &priv->scan.probe_work, HZ / 10);
+                queue_delayed_work(priv->workqueue, &priv->scan.probe_work,
+                                   msecs_to_jiffies(100));
                 mutex_unlock(&priv->conf_mutex);
                 return;
         }
diff --git a/drivers/net/wireless/cw1200/sta.c b/drivers/net/wireless/cw1200/sta.c
index 5b84664db13b..4a47c7f8a246 100644
--- a/drivers/net/wireless/cw1200/sta.c
+++ b/drivers/net/wireless/cw1200/sta.c
@@ -213,6 +213,7 @@ int cw1200_add_interface(struct ieee80211_hw *dev,
         /* __le32 auto_calibration_mode = __cpu_to_le32(1); */
 
         vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER |
+                             IEEE80211_VIF_SUPPORTS_UAPSD |
                              IEEE80211_VIF_SUPPORTS_CQM_RSSI;
 
         mutex_lock(&priv->conf_mutex);
@@ -708,7 +709,8 @@ int cw1200_set_key(struct ieee80211_hw *dev, enum set_key_cmd cmd,
                 if (sta)
                         peer_addr = sta->addr;
 
-                key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
+                key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE |
+                              IEEE80211_KEY_FLAG_RESERVE_TAILROOM;
 
                 switch (key->cipher) {
                 case WLAN_CIPHER_SUITE_WEP40:
diff --git a/drivers/net/wireless/hostap/hostap_ap.c b/drivers/net/wireless/hostap/hostap_ap.c
index 596525528f50..fd8d83dd4f62 100644
--- a/drivers/net/wireless/hostap/hostap_ap.c
+++ b/drivers/net/wireless/hostap/hostap_ap.c
@@ -145,7 +145,7 @@ static void ap_free_sta(struct ap_data *ap, struct sta_info *sta)
         if (sta->aid > 0)
                 ap->sta_aid[sta->aid - 1] = NULL;
 
-        if (!sta->ap && sta->u.sta.challenge)
+        if (!sta->ap)
                 kfree(sta->u.sta.challenge);
         del_timer_sync(&sta->timer);
 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
diff --git a/drivers/net/wireless/iwlegacy/3945-mac.c b/drivers/net/wireless/iwlegacy/3945-mac.c
index dc1d20cf64ee..e5665804d986 100644
--- a/drivers/net/wireless/iwlegacy/3945-mac.c
+++ b/drivers/net/wireless/iwlegacy/3945-mac.c
@@ -3429,9 +3429,7 @@ il3945_setup_deferred_work(struct il_priv *il)
 
         il3945_hw_setup_deferred_work(il);
 
-        init_timer(&il->watchdog);
-        il->watchdog.data = (unsigned long)il;
-        il->watchdog.function = il_bg_watchdog;
+        setup_timer(&il->watchdog, il_bg_watchdog, (unsigned long)il);
 
         tasklet_init(&il->irq_tasklet,
                      (void (*)(unsigned long))il3945_irq_tasklet,
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
index 2748fde4b90c..976f65fe9c38 100644
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
@@ -6247,13 +6247,10 @@ il4965_setup_deferred_work(struct il_priv *il)
 
         INIT_WORK(&il->txpower_work, il4965_bg_txpower_work);
 
-        init_timer(&il->stats_periodic);
-        il->stats_periodic.data = (unsigned long)il;
-        il->stats_periodic.function = il4965_bg_stats_periodic;
+        setup_timer(&il->stats_periodic, il4965_bg_stats_periodic,
+                    (unsigned long)il);
 
-        init_timer(&il->watchdog);
-        il->watchdog.data = (unsigned long)il;
-        il->watchdog.function = il_bg_watchdog;
+        setup_timer(&il->watchdog, il_bg_watchdog, (unsigned long)il);
 
         tasklet_init(&il->irq_tasklet,
                      (void (*)(unsigned long))il4965_irq_tasklet,
diff --git a/drivers/net/wireless/iwlwifi/dvm/main.c b/drivers/net/wireless/iwlwifi/dvm/main.c
index 0b7f46f0b079..c4d6dd7402d9 100644
--- a/drivers/net/wireless/iwlwifi/dvm/main.c
+++ b/drivers/net/wireless/iwlwifi/dvm/main.c
@@ -64,22 +64,8 @@
  *
  ******************************************************************************/
 
-/*
- * module name, copyright, version, etc.
- */
 #define DRV_DESCRIPTION "Intel(R) Wireless WiFi Link AGN driver for Linux"
-
-#ifdef CONFIG_IWLWIFI_DEBUG
-#define VD "d"
-#else
-#define VD
-#endif
-
-#define DRV_VERSION     IWLWIFI_VERSION VD
-
-
 MODULE_DESCRIPTION(DRV_DESCRIPTION);
-MODULE_VERSION(DRV_VERSION);
 MODULE_AUTHOR(DRV_COPYRIGHT " " DRV_AUTHOR);
 MODULE_LICENSE("GPL");
 
@@ -1011,13 +997,11 @@ static void iwl_setup_deferred_work(struct iwl_priv *priv)
         if (priv->lib->bt_params)
                 iwlagn_bt_setup_deferred_work(priv);
 
-        init_timer(&priv->statistics_periodic);
-        priv->statistics_periodic.data = (unsigned long)priv;
-        priv->statistics_periodic.function = iwl_bg_statistics_periodic;
+        setup_timer(&priv->statistics_periodic, iwl_bg_statistics_periodic,
+                    (unsigned long)priv);
 
-        init_timer(&priv->ucode_trace);
-        priv->ucode_trace.data = (unsigned long)priv;
-        priv->ucode_trace.function = iwl_bg_ucode_trace;
+        setup_timer(&priv->ucode_trace, iwl_bg_ucode_trace,
+                    (unsigned long)priv);
 }
 
 void iwl_cancel_deferred_work(struct iwl_priv *priv)
@@ -1244,11 +1228,8 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
         trans_cfg.no_reclaim_cmds = no_reclaim_cmds;
         trans_cfg.n_no_reclaim_cmds = ARRAY_SIZE(no_reclaim_cmds);
         trans_cfg.rx_buf_size_8k = iwlwifi_mod_params.amsdu_size_8K;
-        if (!iwlwifi_mod_params.wd_disable)
-                trans_cfg.queue_watchdog_timeout =
-                        priv->cfg->base_params->wd_timeout;
-        else
-                trans_cfg.queue_watchdog_timeout = IWL_WATCHDOG_DISABLED;
+        trans_cfg.cmd_q_wdg_timeout = IWL_WATCHDOG_DISABLED;
+
         trans_cfg.command_names = iwl_dvm_cmd_strings;
         trans_cfg.cmd_fifo = IWLAGN_CMD_FIFO_NUM;
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/tt.c b/drivers/net/wireless/iwlwifi/dvm/tt.c
index acb981a0a0aa..c4736c8834c5 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tt.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tt.c
@@ -612,15 +612,10 @@ void iwl_tt_initialize(struct iwl_priv *priv)
         memset(tt, 0, sizeof(struct iwl_tt_mgmt));
 
         tt->state = IWL_TI_0;
-        init_timer(&priv->thermal_throttle.ct_kill_exit_tm);
-        priv->thermal_throttle.ct_kill_exit_tm.data = (unsigned long)priv;
-        priv->thermal_throttle.ct_kill_exit_tm.function =
-                iwl_tt_check_exit_ct_kill;
-        init_timer(&priv->thermal_throttle.ct_kill_waiting_tm);
-        priv->thermal_throttle.ct_kill_waiting_tm.data =
-                (unsigned long)priv;
-        priv->thermal_throttle.ct_kill_waiting_tm.function =
-                iwl_tt_ready_for_ct_kill;
+        setup_timer(&priv->thermal_throttle.ct_kill_exit_tm,
+                    iwl_tt_check_exit_ct_kill, (unsigned long)priv);
+        setup_timer(&priv->thermal_throttle.ct_kill_waiting_tm,
+                    iwl_tt_ready_for_ct_kill, (unsigned long)priv);
         /* setup deferred ct kill work */
         INIT_WORK(&priv->tt_work, iwl_bg_tt_work);
         INIT_WORK(&priv->ct_enter, iwl_bg_ct_enter);
diff --git a/drivers/net/wireless/iwlwifi/dvm/tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c
index d1ce3ce13591..1e40a12de077 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
@@ -715,7 +715,7 @@ int iwlagn_tx_agg_oper(struct iwl_priv *priv, struct ieee80211_vif *vif,
         fifo = ctx->ac_to_fifo[tid_to_ac[tid]];
 
         iwl_trans_txq_enable(priv->trans, q, fifo, sta_priv->sta_id, tid,
-                             buf_size, ssn);
+                             buf_size, ssn, 0);
 
         /*
          * If the limit is 0, then it wasn't initialised yet,
diff --git a/drivers/net/wireless/iwlwifi/dvm/ucode.c b/drivers/net/wireless/iwlwifi/dvm/ucode.c
index d5cee1530597..4dbef7e58c2e 100644
--- a/drivers/net/wireless/iwlwifi/dvm/ucode.c
+++ b/drivers/net/wireless/iwlwifi/dvm/ucode.c
@@ -267,7 +267,7 @@ static int iwl_alive_notify(struct iwl_priv *priv)
         for (i = 0; i < n_queues; i++)
                 if (queue_to_txf[i] != IWL_TX_FIFO_UNUSED)
                         iwl_trans_ac_txq_enable(priv->trans, i,
-                                                queue_to_txf[i]);
+                                                queue_to_txf[i], 0);
 
         priv->passive_no_rx = false;
         priv->transport_queue_stop = 0;
diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c
index a5f9198d5747..97e38d2e2983 100644
--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
@@ -92,6 +92,12 @@
 #define IWL7265D_NVM_VERSION            0x0c11
 #define IWL7265_TX_POWER_VERSION        0xffff /* meaningless */
 
+/* DCCM offsets and lengths */
+#define IWL7000_DCCM_OFFSET             0x800000
+#define IWL7260_DCCM_LEN                0x14000
+#define IWL3160_DCCM_LEN                0x10000
+#define IWL7265_DCCM_LEN                0x17A00
+
 #define IWL7260_FW_PRE "iwlwifi-7260-"
 #define IWL7260_MODULE_FIRMWARE(api) IWL7260_FW_PRE __stringify(api) ".ucode"
 
@@ -138,7 +144,8 @@ static const struct iwl_ht_params iwl7000_ht_params = {
         .led_mode = IWL_LED_RF_STATE,                           \
         .nvm_hw_section_num = NVM_HW_SECTION_NUM_FAMILY_7000,   \
         .non_shared_ant = ANT_A,                                \
-        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,    \
+        .dccm_offset = IWL7000_DCCM_OFFSET
 
 const struct iwl_cfg iwl7260_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 7260",
@@ -149,6 +156,7 @@ const struct iwl_cfg iwl7260_2ac_cfg = {
         .nvm_calib_ver = IWL7260_TX_POWER_VERSION,
         .host_interrupt_operation_mode = true,
         .lp_xtal_workaround = true,
+        .dccm_len = IWL7260_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl7260_2ac_cfg_high_temp = {
@@ -161,6 +169,7 @@ const struct iwl_cfg iwl7260_2ac_cfg_high_temp = {
         .high_temp = true,
         .host_interrupt_operation_mode = true,
         .lp_xtal_workaround = true,
+        .dccm_len = IWL7260_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl7260_2n_cfg = {
@@ -172,6 +181,7 @@ const struct iwl_cfg iwl7260_2n_cfg = {
         .nvm_calib_ver = IWL7260_TX_POWER_VERSION,
         .host_interrupt_operation_mode = true,
         .lp_xtal_workaround = true,
+        .dccm_len = IWL7260_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl7260_n_cfg = {
@@ -183,6 +193,7 @@ const struct iwl_cfg iwl7260_n_cfg = {
         .nvm_calib_ver = IWL7260_TX_POWER_VERSION,
         .host_interrupt_operation_mode = true,
         .lp_xtal_workaround = true,
+        .dccm_len = IWL7260_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl3160_2ac_cfg = {
@@ -193,6 +204,7 @@ const struct iwl_cfg iwl3160_2ac_cfg = {
         .nvm_ver = IWL3160_NVM_VERSION,
         .nvm_calib_ver = IWL3160_TX_POWER_VERSION,
         .host_interrupt_operation_mode = true,
+        .dccm_len = IWL3160_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl3160_2n_cfg = {
@@ -203,6 +215,7 @@ const struct iwl_cfg iwl3160_2n_cfg = {
         .nvm_ver = IWL3160_NVM_VERSION,
         .nvm_calib_ver = IWL3160_TX_POWER_VERSION,
         .host_interrupt_operation_mode = true,
+        .dccm_len = IWL3160_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl3160_n_cfg = {
@@ -213,6 +226,7 @@ const struct iwl_cfg iwl3160_n_cfg = {
         .nvm_ver = IWL3160_NVM_VERSION,
         .nvm_calib_ver = IWL3160_TX_POWER_VERSION,
         .host_interrupt_operation_mode = true,
+        .dccm_len = IWL3160_DCCM_LEN,
 };
 
 static const struct iwl_pwr_tx_backoff iwl7265_pwr_tx_backoffs[] = {
@@ -240,6 +254,7 @@ const struct iwl_cfg iwl3165_2ac_cfg = {
         .nvm_ver = IWL3165_NVM_VERSION,
         .nvm_calib_ver = IWL3165_TX_POWER_VERSION,
         .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+        .dccm_len = IWL7265_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl7265_2ac_cfg = {
@@ -250,6 +265,7 @@ const struct iwl_cfg iwl7265_2ac_cfg = {
         .nvm_ver = IWL7265_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
         .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+        .dccm_len = IWL7265_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl7265_2n_cfg = {
@@ -260,6 +276,7 @@ const struct iwl_cfg iwl7265_2n_cfg = {
         .nvm_ver = IWL7265_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
         .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+        .dccm_len = IWL7265_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl7265_n_cfg = {
@@ -270,6 +287,7 @@ const struct iwl_cfg iwl7265_n_cfg = {
         .nvm_ver = IWL7265_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
         .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+        .dccm_len = IWL7265_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl7265d_2ac_cfg = {
@@ -280,6 +298,7 @@ const struct iwl_cfg iwl7265d_2ac_cfg = {
         .nvm_ver = IWL7265D_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
         .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+        .dccm_len = IWL7265_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl7265d_2n_cfg = {
@@ -290,6 +309,7 @@ const struct iwl_cfg iwl7265d_2n_cfg = {
         .nvm_ver = IWL7265D_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
         .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+        .dccm_len = IWL7265_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl7265d_n_cfg = {
@@ -300,6 +320,7 @@ const struct iwl_cfg iwl7265d_n_cfg = {
         .nvm_ver = IWL7265D_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
         .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+        .dccm_len = IWL7265_DCCM_LEN,
 };
 
 MODULE_FIRMWARE(IWL7260_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
diff --git a/drivers/net/wireless/iwlwifi/iwl-8000.c b/drivers/net/wireless/iwlwifi/iwl-8000.c
index 3668fc57e770..2f7fe8167dc9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-8000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-8000.c
@@ -81,12 +81,21 @@
 #define IWL8000_NVM_VERSION             0x0a1d
 #define IWL8000_TX_POWER_VERSION        0xffff /* meaningless */
 
+/* Memory offsets and lengths */
+#define IWL8260_DCCM_OFFSET             0x800000
+#define IWL8260_DCCM_LEN                0x18000
+#define IWL8260_DCCM2_OFFSET            0x880000
+#define IWL8260_DCCM2_LEN               0x8000
+#define IWL8260_SMEM_OFFSET             0x400000
+#define IWL8260_SMEM_LEN                0x68000
+
 #define IWL8000_FW_PRE "iwlwifi-8000"
 #define IWL8000_MODULE_FIRMWARE(api) \
         IWL8000_FW_PRE "-" __stringify(api) ".ucode"
 
 #define NVM_HW_SECTION_NUM_FAMILY_8000          10
-#define DEFAULT_NVM_FILE_FAMILY_8000            "iwl_nvm_8000.bin"
+#define DEFAULT_NVM_FILE_FAMILY_8000A           "iwl_nvm_8000.bin"
+#define DEFAULT_NVM_FILE_FAMILY_8000            "iwl_nvm_8000B.bin"
 
 /* Max SDIO RX aggregation size of the ADDBA request/response */
 #define MAX_RX_AGG_SIZE_8260_SDIO       28
@@ -124,7 +133,13 @@ static const struct iwl_ht_params iwl8000_ht_params = {
         .led_mode = IWL_LED_RF_STATE,                           \
         .nvm_hw_section_num = NVM_HW_SECTION_NUM_FAMILY_8000,   \
         .d0i3 = true,                                           \
-        .non_shared_ant = ANT_A
+        .non_shared_ant = ANT_A,                                \
+        .dccm_offset = IWL8260_DCCM_OFFSET,                     \
+        .dccm_len = IWL8260_DCCM_LEN,                           \
+        .dccm2_offset = IWL8260_DCCM2_OFFSET,                   \
+        .dccm2_len = IWL8260_DCCM2_LEN,                         \
+        .smem_offset = IWL8260_SMEM_OFFSET,                     \
+        .smem_len = IWL8260_SMEM_LEN
 
 const struct iwl_cfg iwl8260_2n_cfg = {
         .name = "Intel(R) Dual Band Wireless N 8260",
@@ -145,6 +160,16 @@ const struct iwl_cfg iwl8260_2ac_cfg = {
         .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
 };
 
+const struct iwl_cfg iwl4165_2ac_cfg = {
+        .name = "Intel(R) Dual Band Wireless AC 4165",
+        .fw_name_pre = IWL8000_FW_PRE,
+        IWL_DEVICE_8000,
+        .ht_params = &iwl8000_ht_params,
+        .nvm_ver = IWL8000_NVM_VERSION,
+        .nvm_calib_ver = IWL8000_TX_POWER_VERSION,
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+};
+
 const struct iwl_cfg iwl8260_2ac_sdio_cfg = {
         .name = "Intel(R) Dual Band Wireless-AC 8260",
         .fw_name_pre = IWL8000_FW_PRE,
@@ -153,6 +178,7 @@ const struct iwl_cfg iwl8260_2ac_sdio_cfg = {
         .nvm_ver = IWL8000_NVM_VERSION,
         .nvm_calib_ver = IWL8000_TX_POWER_VERSION,
         .default_nvm_file = DEFAULT_NVM_FILE_FAMILY_8000,
+        .default_nvm_file_8000A = DEFAULT_NVM_FILE_FAMILY_8000A,
         .max_rx_agg_size = MAX_RX_AGG_SIZE_8260_SDIO,
         .disable_dummy_notification = true,
         .max_ht_ampdu_exponent  = MAX_HT_AMPDU_EXPONENT_8260_SDIO,
@@ -167,6 +193,7 @@ const struct iwl_cfg iwl4165_2ac_sdio_cfg = {
         .nvm_ver = IWL8000_NVM_VERSION,
         .nvm_calib_ver = IWL8000_TX_POWER_VERSION,
         .default_nvm_file = DEFAULT_NVM_FILE_FAMILY_8000,
+        .default_nvm_file_8000A = DEFAULT_NVM_FILE_FAMILY_8000A,
         .max_rx_agg_size = MAX_RX_AGG_SIZE_8260_SDIO,
         .bt_shared_single_ant = true,
         .disable_dummy_notification = true,
diff --git a/drivers/net/wireless/iwlwifi/iwl-config.h b/drivers/net/wireless/iwlwifi/iwl-config.h
index 3a4b9c7fc083..4b190d98a1ec 100644
--- a/drivers/net/wireless/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/iwlwifi/iwl-config.h
@@ -126,7 +126,7 @@ enum iwl_led_mode {
 
 /* TX queue watchdog timeouts in mSecs */
 #define IWL_WATCHDOG_DISABLED   0
-#define IWL_DEF_WD_TIMEOUT      2000
+#define IWL_DEF_WD_TIMEOUT      2500
 #define IWL_LONG_WD_TIMEOUT     10000
 #define IWL_MAX_WD_TIMEOUT      120000
 
@@ -261,6 +261,12 @@ struct iwl_pwr_tx_backoff {
  *      station can receive in HT
  * @max_vht_ampdu_exponent: the exponent of the max length of A-MPDU that the
  *      station can receive in VHT
+ * @dccm_offset: offset from which DCCM begins
+ * @dccm_len: length of DCCM (including runtime stack CCM)
+ * @dccm2_offset: offset from which the second DCCM begins
+ * @dccm2_len: length of the second DCCM
+ * @smem_offset: offset from which the SMEM begins
+ * @smem_len: the length of SMEM
  *
  * We enable the driver to be backward compatible wrt. hardware features.
  * API differences in uCode shouldn't be handled here but through TLVs
@@ -298,11 +304,18 @@ struct iwl_cfg {
         const struct iwl_pwr_tx_backoff *pwr_tx_backoffs;
         bool no_power_up_nic_in_init;
         const char *default_nvm_file;
+        const char *default_nvm_file_8000A;
         unsigned int max_rx_agg_size;
         bool disable_dummy_notification;
         unsigned int max_tx_agg_size;
         unsigned int max_ht_ampdu_exponent;
         unsigned int max_vht_ampdu_exponent;
+        const u32 dccm_offset;
+        const u32 dccm_len;
+        const u32 dccm2_offset;
+        const u32 dccm2_len;
+        const u32 smem_offset;
+        const u32 smem_len;
 };
 
 /*
@@ -369,8 +382,8 @@ extern const struct iwl_cfg iwl7265d_2n_cfg;
 extern const struct iwl_cfg iwl7265d_n_cfg;
 extern const struct iwl_cfg iwl8260_2n_cfg;
 extern const struct iwl_cfg iwl8260_2ac_cfg;
+extern const struct iwl_cfg iwl4165_2ac_cfg;
 extern const struct iwl_cfg iwl8260_2ac_sdio_cfg;
-extern const struct iwl_cfg iwl4265_2ac_sdio_cfg;
 extern const struct iwl_cfg iwl4165_2ac_sdio_cfg;
 #endif /* CONFIG_IWLMVM */
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h
index aff63c3f5bf8..faa17f2e352a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/iwlwifi/iwl-csr.h
@@ -184,6 +184,7 @@
 #define CSR_HW_IF_CONFIG_REG_BIT_NIC_READY      (0x00400000) /* PCI_OWN_SEM */
 #define CSR_HW_IF_CONFIG_REG_BIT_NIC_PREPARE_DONE (0x02000000) /* ME_OWN */
 #define CSR_HW_IF_CONFIG_REG_PREPARE              (0x08000000) /* WAKE_ME */
+#define CSR_HW_IF_CONFIG_REG_ENABLE_PME           (0x10000000)
 #define CSR_HW_IF_CONFIG_REG_PERSIST_MODE         (0x40000000) /* PERSISTENCE */
 
 #define CSR_MBOX_SET_REG_OS_ALIVE               BIT(5)
@@ -306,6 +307,7 @@
 enum {
         SILICON_A_STEP = 0,
         SILICON_B_STEP,
+        SILICON_C_STEP,
 };
 
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.c b/drivers/net/wireless/iwlwifi/iwl-drv.c
index 850b85a47806..996e7f16adf9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.c
@@ -84,21 +84,8 @@
  *
  ******************************************************************************/
 
-/*
- * module name, copyright, version, etc.
- */
 #define DRV_DESCRIPTION "Intel(R) Wireless WiFi driver for Linux"
-
-#ifdef CONFIG_IWLWIFI_DEBUG
-#define VD "d"
-#else
-#define VD
-#endif
-
-#define DRV_VERSION     IWLWIFI_VERSION VD
-
 MODULE_DESCRIPTION(DRV_DESCRIPTION);
-MODULE_VERSION(DRV_VERSION);
 MODULE_AUTHOR(DRV_COPYRIGHT " " DRV_AUTHOR);
 MODULE_LICENSE("GPL");
 
@@ -250,9 +237,6 @@ static int iwl_request_firmware(struct iwl_drv *drv, bool first)
         /*
          * Starting 8000B - FW name format has changed. This overwrites the
          * previous name and uses the new format.
-         *
-         * TODO:
-         * Once there is only one supported step for 8000 family - delete this!
          */
         if (drv->trans->cfg->device_family == IWL_DEVICE_FAMILY_8000) {
                 char rev_step[2] = {
@@ -263,13 +247,6 @@ static int iwl_request_firmware(struct iwl_drv *drv, bool first)
                 if (CSR_HW_REV_STEP(drv->trans->hw_rev) == SILICON_A_STEP)
                         rev_step[0] = 0;
 
-                /*
-                 * If hw_rev wasn't set yet - default as B-step. If it IS A-step
-                 * we'll reload that FW later instead.
-                 */
-                if (drv->trans->hw_rev == 0)
-                        rev_step[0] = 'B';
-
                 snprintf(drv->firmware_name, sizeof(drv->firmware_name),
                          "%s%s-%s.ucode", name_pre, rev_step, tag);
         }
@@ -926,6 +903,12 @@ static int iwl_parse_tlv_firmware(struct iwl_drv *drv,
                                             IWL_UCODE_REGULAR_USNIFFER,
                                             tlv_len);
                         break;
+                case IWL_UCODE_TLV_SDIO_ADMA_ADDR:
+                        if (tlv_len != sizeof(u32))
+                                goto invalid_tlv_len;
+                        drv->fw.sdio_adma_addr =
+                                le32_to_cpup((__le32 *)tlv_data);
+                        break;
                 default:
                         IWL_DEBUG_INFO(drv, "unknown TLV: %d\n", tlv_type);
                         break;
@@ -1082,7 +1065,6 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context)
         u32 api_ver;
         int i;
         bool load_module = false;
-        u32 hw_rev = drv->trans->hw_rev;
 
         fw->ucode_capa.max_probe_length = IWL_DEFAULT_MAX_PROBE_LENGTH;
         fw->ucode_capa.standard_phy_calibration_size =
@@ -1275,50 +1257,6 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context)
                                 op->name, err);
 #endif
         }
-
-        /*
-         * We may have loaded the wrong FW file in 8000 HW family if it is an
-         * A-step card, and if drv->trans->hw_rev wasn't properly read when
-         * the FW file had been loaded. (This might happen in SDIO.) In such a
-         * case - unload and reload the correct file.
-         *
-         * TODO:
-         * Once there is only one supported step for 8000 family - delete this!
-         */
-        if (drv->trans->cfg->device_family == IWL_DEVICE_FAMILY_8000 &&
-            CSR_HW_REV_STEP(drv->trans->hw_rev) == SILICON_A_STEP &&
-            drv->trans->hw_rev != hw_rev) {
-                char firmware_name[32];
-
-                /* Free previous FW resources */
-                if (drv->op_mode)
-                        _iwl_op_mode_stop(drv);
-                iwl_dealloc_ucode(drv);
-
-                /* Build name of correct-step FW */
-                snprintf(firmware_name, sizeof(firmware_name),
-                         strrchr(drv->firmware_name, '-'));
-                snprintf(drv->firmware_name, sizeof(drv->firmware_name),
-                         "%s%s", drv->cfg->fw_name_pre, firmware_name);
-
-                /* Clear data before loading correct FW */
-                list_del(&drv->list);
-
-                /* Request correct FW file this time */
-                IWL_DEBUG_INFO(drv, "attempting to load A-step FW %s\n",
-                               drv->firmware_name);
-                err = request_firmware(&ucode_raw, drv->firmware_name,
-                                       drv->trans->dev);
-                if (err) {
-                        IWL_ERR(drv, "Failed swapping FW!\n");
-                        goto out_unbind;
-                }
-
-                /* Redo callback function - this time with right FW */
-                iwl_req_fw_callback(ucode_raw, context);
-        }
-
-        kfree(pieces);
         return;
 
  try_again:
@@ -1429,7 +1367,7 @@ struct iwl_mod_params iwlwifi_mod_params = {
         .restart_fw = true,
         .bt_coex_active = true,
         .power_level = IWL_POWER_INDEX_1,
-        .wd_disable = true,
+        .d0i3_disable = true,
 #ifndef CONFIG_IWLWIFI_UAPSD
         .uapsd_disable = true,
 #endif /* CONFIG_IWLWIFI_UAPSD */
@@ -1492,7 +1430,7 @@ static int __init iwl_drv_init(void)
         for (i = 0; i < ARRAY_SIZE(iwlwifi_opmode_table); i++)
                 INIT_LIST_HEAD(&iwlwifi_opmode_table[i].drv);
 
-        pr_info(DRV_DESCRIPTION ", " DRV_VERSION "\n");
+        pr_info(DRV_DESCRIPTION "\n");
         pr_info(DRV_COPYRIGHT "\n");
 
 #ifdef CONFIG_IWLWIFI_DEBUGFS
@@ -1539,15 +1477,15 @@ module_param_named(antenna_coupling, iwlwifi_mod_params.ant_coupling,
 MODULE_PARM_DESC(antenna_coupling,
                  "specify antenna coupling in dB (default: 0 dB)");
 
-module_param_named(wd_disable, iwlwifi_mod_params.wd_disable, int, S_IRUGO);
-MODULE_PARM_DESC(wd_disable,
-                "Disable stuck queue watchdog timer 0=system default, 1=disable (default: 1)");
-
 module_param_named(nvm_file, iwlwifi_mod_params.nvm_file, charp, S_IRUGO);
 MODULE_PARM_DESC(nvm_file, "NVM file name");
 
-module_param_named(uapsd_disable, iwlwifi_mod_params.uapsd_disable,
+module_param_named(d0i3_disable, iwlwifi_mod_params.d0i3_disable,
                    bool, S_IRUGO);
+MODULE_PARM_DESC(d0i3_disable, "disable d0i3 functionality (default: Y)");
+
+module_param_named(uapsd_disable, iwlwifi_mod_params.uapsd_disable,
+                   bool, S_IRUGO | S_IWUSR);
 #ifdef CONFIG_IWLWIFI_UAPSD
 MODULE_PARM_DESC(uapsd_disable, "disable U-APSD functionality (default: N)");
 #else
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.h b/drivers/net/wireless/iwlwifi/iwl-drv.h
index be4f8972241a..adf522c756e6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.h
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.h
@@ -68,7 +68,6 @@
 
 /* for all modules */
 #define DRV_NAME        "iwlwifi"
-#define IWLWIFI_VERSION "in-tree:"
 #define DRV_COPYRIGHT   "Copyright(c) 2003- 2014 Intel Corporation"
 #define DRV_AUTHOR     "<ilw@linux.intel.com>"
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw-error-dump.h b/drivers/net/wireless/iwlwifi/iwl-fw-error-dump.h
index 20a8a64c9fe3..919a2548a92c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw-error-dump.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw-error-dump.h
@@ -71,7 +71,6 @@
 
 /**
  * enum iwl_fw_error_dump_type - types of data in the dump file
- * @IWL_FW_ERROR_DUMP_SRAM:
  * @IWL_FW_ERROR_DUMP_CSR: Control Status Registers - from offset 0
  * @IWL_FW_ERROR_DUMP_RXF:
  * @IWL_FW_ERROR_DUMP_TXCMD: last TX command data, structured as
@@ -82,9 +81,10 @@
  * @IWL_FW_ERROR_DUMP_PRPH: range of periphery registers - there can be several
  *      sections like this in a single file.
  * @IWL_FW_ERROR_DUMP_FH_REGS: range of FH registers
+ * @IWL_FW_ERROR_DUMP_MEM: chunk of memory
  */
 enum iwl_fw_error_dump_type {
-        IWL_FW_ERROR_DUMP_SRAM = 0,
+        /* 0 is deprecated */
         IWL_FW_ERROR_DUMP_CSR = 1,
         IWL_FW_ERROR_DUMP_RXF = 2,
         IWL_FW_ERROR_DUMP_TXCMD = 3,
@@ -93,6 +93,7 @@ enum iwl_fw_error_dump_type {
         IWL_FW_ERROR_DUMP_PRPH = 6,
         IWL_FW_ERROR_DUMP_TXF = 7,
         IWL_FW_ERROR_DUMP_FH_REGS = 8,
+        IWL_FW_ERROR_DUMP_MEM = 9,
 
         IWL_FW_ERROR_DUMP_MAX,
 };
@@ -133,6 +134,27 @@ struct iwl_fw_error_dump_txcmd {
         u8 data[];
 } __packed;
 
+/**
+ * struct iwl_fw_error_dump_fifo - RX/TX FIFO data
+ * @fifo_num: number of FIFO (starting from 0)
+ * @available_bytes: num of bytes available in FIFO (may be less than FIFO size)
+ * @wr_ptr: position of write pointer
+ * @rd_ptr: position of read pointer
+ * @fence_ptr: position of fence pointer
+ * @fence_mode: the current mode of the fence (before locking) -
+ *      0=follow RD pointer ; 1 = freeze
+ * @data: all of the FIFO's data
+ */
+struct iwl_fw_error_dump_fifo {
+        __le32 fifo_num;
+        __le32 available_bytes;
+        __le32 wr_ptr;
+        __le32 rd_ptr;
+        __le32 fence_ptr;
+        __le32 fence_mode;
+        u8 data[];
+} __packed;
+
 enum iwl_fw_error_dump_family {
         IWL_FW_ERROR_DUMP_FAMILY_7 = 7,
         IWL_FW_ERROR_DUMP_FAMILY_8 = 8,
@@ -180,6 +202,23 @@ struct iwl_fw_error_dump_prph {
         __le32 data[];
 };
 
+enum iwl_fw_error_dump_mem_type {
+        IWL_FW_ERROR_DUMP_MEM_SRAM,
+        IWL_FW_ERROR_DUMP_MEM_SMEM,
+};
+
+/**
+ * struct iwl_fw_error_dump_mem - chunk of memory
+ * @type: %enum iwl_fw_error_dump_mem_type
+ * @offset: the offset from which the memory was read
+ * @data: the content of the memory
+ */
+struct iwl_fw_error_dump_mem {
+        __le32 type;
+        __le32 offset;
+        u8 data[];
+};
+
 /**
  * iwl_fw_error_next_data - advance fw error dump data pointer
  * @data: previous data block
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw-file.h b/drivers/net/wireless/iwlwifi/iwl-fw-file.h
index 660ddb1b7d8a..016d91384681 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw-file.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw-file.h
@@ -132,6 +132,7 @@ enum iwl_ucode_tlv_type {
         IWL_UCODE_TLV_ENABLED_CAPABILITIES      = 30,
         IWL_UCODE_TLV_N_SCAN_CHANNELS           = 31,
         IWL_UCODE_TLV_SEC_RT_USNIFFER   = 34,
+        IWL_UCODE_TLV_SDIO_ADMA_ADDR    = 35,
         IWL_UCODE_TLV_FW_DBG_DEST       = 38,
         IWL_UCODE_TLV_FW_DBG_CONF       = 39,
 };
@@ -234,31 +235,34 @@ enum iwl_ucode_tlv_flag {
 
 /**
  * enum iwl_ucode_tlv_api - ucode api
- * @IWL_UCODE_TLV_API_WOWLAN_CONFIG_TID: wowlan config includes tid field.
- * @IWL_UCODE_TLV_CAPA_EXTENDED_BEACON: Support Extended beacon notification
  * @IWL_UCODE_TLV_API_BT_COEX_SPLIT: new API for BT Coex
- * @IWL_UCODE_TLV_API_CSA_FLOW: ucode can do unbind-bind flow for CSA.
  * @IWL_UCODE_TLV_API_DISABLE_STA_TX: ucode supports tx_disable bit.
  * @IWL_UCODE_TLV_API_LMAC_SCAN: This ucode uses LMAC unified scan API.
  * @IWL_UCODE_TLV_API_SF_NO_DUMMY_NOTIF: ucode supports disabling dummy notif.
  * @IWL_UCODE_TLV_API_FRAGMENTED_SCAN: This ucode supports active dwell time
  *      longer than the passive one, which is essential for fragmented scan.
+ * IWL_UCODE_TLV_API_HDC_PHASE_0: ucode supports finer configuration of LTR
  * @IWL_UCODE_TLV_API_BASIC_DWELL: use only basic dwell time in scan command,
  *      regardless of the band or the number of the probes. FW will calculate
  *      the actual dwell time.
+ * @IWL_UCODE_TLV_API_SCD_CFG: This firmware can configure the scheduler
+ *      through the dedicated host command.
  * @IWL_UCODE_TLV_API_SINGLE_SCAN_EBS: EBS is supported for single scans too.
+ * @IWL_UCODE_TLV_API_ASYNC_DTM: Async temperature notifications are supported.
+ * @IWL_UCODE_TLV_API_LQ_SS_PARAMS: Configure STBC/BFER via LQ CMD ss_params
  */
 enum iwl_ucode_tlv_api {
-        IWL_UCODE_TLV_API_WOWLAN_CONFIG_TID     = BIT(0),
-        IWL_UCODE_TLV_CAPA_EXTENDED_BEACON      = BIT(1),
         IWL_UCODE_TLV_API_BT_COEX_SPLIT         = BIT(3),
-        IWL_UCODE_TLV_API_CSA_FLOW              = BIT(4),
         IWL_UCODE_TLV_API_DISABLE_STA_TX        = BIT(5),
         IWL_UCODE_TLV_API_LMAC_SCAN             = BIT(6),
         IWL_UCODE_TLV_API_SF_NO_DUMMY_NOTIF     = BIT(7),
         IWL_UCODE_TLV_API_FRAGMENTED_SCAN       = BIT(8),
+        IWL_UCODE_TLV_API_HDC_PHASE_0           = BIT(10),
         IWL_UCODE_TLV_API_BASIC_DWELL           = BIT(13),
+        IWL_UCODE_TLV_API_SCD_CFG               = BIT(15),
         IWL_UCODE_TLV_API_SINGLE_SCAN_EBS       = BIT(16),
+        IWL_UCODE_TLV_API_ASYNC_DTM             = BIT(17),
+        IWL_UCODE_TLV_API_LQ_SS_PARAMS          = BIT(18),
 };
 
 /**
@@ -266,6 +270,7 @@ enum iwl_ucode_tlv_api {
  * @IWL_UCODE_TLV_CAPA_D0I3_SUPPORT: supports D0i3
  * @IWL_UCODE_TLV_CAPA_LAR_SUPPORT: supports Location Aware Regulatory
  * @IWL_UCODE_TLV_CAPA_UMAC_SCAN: supports UMAC scan.
+ * @IWL_UCODE_TLV_CAPA_BEAMFORMER: supports Beamformer
  * @IWL_UCODE_TLV_CAPA_TDLS_SUPPORT: support basic TDLS functionality
  * @IWL_UCODE_TLV_CAPA_TXPOWER_INSERTION_SUPPORT: supports insertion of current
  *      tx power value into TPC Report action frame and Link Measurement Report
@@ -284,6 +289,7 @@ enum iwl_ucode_tlv_capa {
         IWL_UCODE_TLV_CAPA_D0I3_SUPPORT                 = BIT(0),
         IWL_UCODE_TLV_CAPA_LAR_SUPPORT                  = BIT(1),
         IWL_UCODE_TLV_CAPA_UMAC_SCAN                    = BIT(2),
+        IWL_UCODE_TLV_CAPA_BEAMFORMER                   = BIT(3),
         IWL_UCODE_TLV_CAPA_TDLS_SUPPORT                 = BIT(6),
         IWL_UCODE_TLV_CAPA_TXPOWER_INSERTION_SUPPORT    = BIT(8),
         IWL_UCODE_TLV_CAPA_DS_PARAM_SET_IE_SUPPORT      = BIT(9),
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw.h b/drivers/net/wireless/iwlwifi/iwl-fw.h
index e6dc3b870949..ffd785cc67d6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw.h
@@ -152,6 +152,8 @@ struct iwl_fw_cscheme_list {
  * @mvm_fw: indicates this is MVM firmware
  * @cipher_scheme: optional external cipher scheme.
  * @human_readable: human readable version
+ * @sdio_adma_addr: the default address to set for the ADMA in SDIO mode until
+ *      we get the ALIVE from the uCode
  * @dbg_dest_tlv: points to the destination TLV for debug
  * @dbg_conf_tlv: array of pointers to configuration TLVs for debug
  * @dbg_conf_tlv_len: lengths of the @dbg_conf_tlv entries
@@ -181,6 +183,8 @@ struct iwl_fw {
         struct ieee80211_cipher_scheme cs[IWL_UCODE_MAX_CS];
         u8 human_readable[FW_VER_HUMAN_READABLE_SZ];
 
+        u32 sdio_adma_addr;
+
         struct iwl_fw_dbg_dest_tlv *dbg_dest_tlv;
         struct iwl_fw_dbg_conf_tlv *dbg_conf_tlv[FW_DBG_MAX];
         size_t dbg_conf_tlv_len[FW_DBG_MAX];
diff --git a/drivers/net/wireless/iwlwifi/iwl-io.c b/drivers/net/wireless/iwlwifi/iwl-io.c
index 7a2cbf6f90db..03250a45272e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-io.c
+++ b/drivers/net/wireless/iwlwifi/iwl-io.c
@@ -193,11 +193,15 @@ void iwl_force_nmi(struct iwl_trans *trans)
          * DEVICE_SET_NMI_8000B_REG - is used.
          */
         if ((trans->cfg->device_family != IWL_DEVICE_FAMILY_8000) ||
-            (CSR_HW_REV_STEP(trans->hw_rev) == SILICON_A_STEP))
-                iwl_write_prph(trans, DEVICE_SET_NMI_REG, DEVICE_SET_NMI_VAL);
-        else
+            (CSR_HW_REV_STEP(trans->hw_rev) == SILICON_A_STEP)) {
+                iwl_write_prph(trans, DEVICE_SET_NMI_REG,
+                               DEVICE_SET_NMI_VAL_DRV);
+                iwl_write_prph(trans, DEVICE_SET_NMI_REG,
+                               DEVICE_SET_NMI_VAL_HW);
+        } else {
                 iwl_write_prph(trans, DEVICE_SET_NMI_8000B_REG,
                                DEVICE_SET_NMI_8000B_VAL);
+        }
 }
 IWL_EXPORT_SYMBOL(iwl_force_nmi);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-modparams.h b/drivers/net/wireless/iwlwifi/iwl-modparams.h
index 71507cf490e6..e8eabd21ccfe 100644
--- a/drivers/net/wireless/iwlwifi/iwl-modparams.h
+++ b/drivers/net/wireless/iwlwifi/iwl-modparams.h
@@ -96,13 +96,13 @@ enum iwl_disable_11n {
  *      use IWL_[DIS,EN]ABLE_HT_* constants
  * @amsdu_size_8K: enable 8K amsdu size, default = 0
  * @restart_fw: restart firmware, default = 1
- * @wd_disable: disable stuck queue check, default = 1
  * @bt_coex_active: enable bt coex, default = true
  * @led_mode: system default, default = 0
  * @power_save: enable power save, default = false
  * @power_level: power level, default = 1
  * @debug_level: levels are IWL_DL_*
  * @ant_coupling: antenna coupling in dB, default = 0
+ * @d0i3_disable: disable d0i3, default = 1,
  * @fw_monitor: allow to use firmware monitor
  */
 struct iwl_mod_params {
@@ -110,7 +110,6 @@ struct iwl_mod_params {
         unsigned int disable_11n;
         int amsdu_size_8K;
         bool restart_fw;
-        int  wd_disable;
         bool bt_coex_active;
         int led_mode;
         bool power_save;
@@ -121,6 +120,7 @@ struct iwl_mod_params {
         int ant_coupling;
         char *nvm_file;
         bool uapsd_disable;
+        bool d0i3_disable;
         bool fw_monitor;
 };
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
index 06e02fcd6f7b..c74f1a4edf23 100644
--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
@@ -468,6 +468,8 @@ static void iwl_set_radio_cfg(const struct iwl_cfg *cfg,
         data->radio_cfg_step = NVM_RF_CFG_STEP_MSK_FAMILY_8000(radio_cfg);
         data->radio_cfg_dash = NVM_RF_CFG_DASH_MSK_FAMILY_8000(radio_cfg);
         data->radio_cfg_pnum = NVM_RF_CFG_FLAVOR_MSK_FAMILY_8000(radio_cfg);
+        data->valid_tx_ant = NVM_RF_CFG_TX_ANT_MSK_FAMILY_8000(radio_cfg);
+        data->valid_rx_ant = NVM_RF_CFG_RX_ANT_MSK_FAMILY_8000(radio_cfg);
 }
 
 static void iwl_set_hw_address(const struct iwl_cfg *cfg,
@@ -592,6 +594,10 @@ iwl_parse_nvm_data(struct device *dev, const struct iwl_cfg *cfg,
 
         radio_cfg = iwl_get_radio_cfg(cfg, nvm_sw);
         iwl_set_radio_cfg(cfg, data, radio_cfg);
+        if (data->valid_tx_ant)
+                tx_chains &= data->valid_tx_ant;
+        if (data->valid_rx_ant)
+                rx_chains &= data->valid_rx_ant;
 
         sku = iwl_get_sku(cfg, nvm_sw);
         data->sku_cap_band_24GHz_enable = sku & NVM_SKU_CAP_BAND_24GHZ;
diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
index 2df51eab1348..6221e4dfc64f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
@@ -99,6 +99,7 @@
 
 #define APMG_PCIDEV_STT_VAL_PERSIST_DIS (0x00000200)
 #define APMG_PCIDEV_STT_VAL_L1_ACT_DIS  (0x00000800)
+#define APMG_PCIDEV_STT_VAL_WAKE_ME     (0x00004000)
 
 #define APMG_RTC_INT_STT_RFKILL         (0x10000000)
 
@@ -107,7 +108,8 @@
 
 /* Device NMI register */
 #define DEVICE_SET_NMI_REG 0x00a01c30
-#define DEVICE_SET_NMI_VAL 0x1
+#define DEVICE_SET_NMI_VAL_HW BIT(0)
+#define DEVICE_SET_NMI_VAL_DRV BIT(7)
 #define DEVICE_SET_NMI_8000B_REG 0x00a01c24
 #define DEVICE_SET_NMI_8000B_VAL 0x1000000
 
@@ -250,6 +252,7 @@
 #define SCD_QUEUE_CTX_REG2_WIN_SIZE_MSK         (0x0000007F)
 #define SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS      (16)
 #define SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK      (0x007F0000)
+#define SCD_GP_CTRL_ENABLE_31_QUEUES            BIT(0)
 
 /* Context Data */
 #define SCD_CONTEXT_MEM_LOWER_BOUND     (SCD_MEM_LOWER_BOUND + 0x600)
@@ -283,32 +286,9 @@
 #define SCD_CHAINEXT_EN         (SCD_BASE + 0x244)
 #define SCD_AGGR_SEL            (SCD_BASE + 0x248)
 #define SCD_INTERRUPT_MASK      (SCD_BASE + 0x108)
+#define SCD_GP_CTRL             (SCD_BASE + 0x1a8)
 #define SCD_EN_CTRL             (SCD_BASE + 0x254)
 
-static inline unsigned int SCD_QUEUE_WRPTR(unsigned int chnl)
-{
-        if (chnl < 20)
-                return SCD_BASE + 0x18 + chnl * 4;
-        WARN_ON_ONCE(chnl >= 32);
-        return SCD_BASE + 0x284 + (chnl - 20) * 4;
-}
-
-static inline unsigned int SCD_QUEUE_RDPTR(unsigned int chnl)
-{
-        if (chnl < 20)
-                return SCD_BASE + 0x68 + chnl * 4;
-        WARN_ON_ONCE(chnl >= 32);
-        return SCD_BASE + 0x2B4 + (chnl - 20) * 4;
-}
-
-static inline unsigned int SCD_QUEUE_STATUS_BITS(unsigned int chnl)
-{
-        if (chnl < 20)
-                return SCD_BASE + 0x10c + chnl * 4;
-        WARN_ON_ONCE(chnl >= 32);
-        return SCD_BASE + 0x384 + (chnl - 20) * 4;
-}
-
 /*********************** END TX SCHEDULER *************************************/
 
 /* Oscillator clock */
@@ -358,18 +338,40 @@ enum secure_load_status_reg {
 
 /* Rx FIFO */
 #define RXF_SIZE_ADDR                   (0xa00c88)
+#define RXF_RD_D_SPACE                  (0xa00c40)
+#define RXF_RD_WR_PTR                   (0xa00c50)
+#define RXF_RD_RD_PTR                   (0xa00c54)
+#define RXF_RD_FENCE_PTR                (0xa00c4c)
+#define RXF_SET_FENCE_MODE              (0xa00c14)
+#define RXF_LD_WR2FENCE         (0xa00c1c)
+#define RXF_FIFO_RD_FENCE_INC           (0xa00c68)
 #define RXF_SIZE_BYTE_CND_POS           (7)
 #define RXF_SIZE_BYTE_CNT_MSK           (0x3ff << RXF_SIZE_BYTE_CND_POS)
+#define RXF_DIFF_FROM_PREV              (0x200)
 
 #define RXF_LD_FENCE_OFFSET_ADDR        (0xa00c10)
 #define RXF_FIFO_RD_FENCE_ADDR          (0xa00c0c)
 
+/* Tx FIFO */
+#define TXF_FIFO_ITEM_CNT               (0xa00438)
+#define TXF_WR_PTR                      (0xa00414)
+#define TXF_RD_PTR                      (0xa00410)
+#define TXF_FENCE_PTR                   (0xa00418)
+#define TXF_LOCK_FENCE                  (0xa00424)
+#define TXF_LARC_NUM                    (0xa0043c)
+#define TXF_READ_MODIFY_DATA            (0xa00448)
+#define TXF_READ_MODIFY_ADDR            (0xa0044c)
+
 /* FW monitor */
+#define MON_BUFF_SAMPLE_CTL             (0xa03c00)
 #define MON_BUFF_BASE_ADDR              (0xa03c3c)
 #define MON_BUFF_END_ADDR               (0xa03c40)
 #define MON_BUFF_WRPTR                  (0xa03c44)
 #define MON_BUFF_CYCLE_CNT              (0xa03c48)
 
+#define DBGC_IN_SAMPLE                  (0xa03c00)
+#define DBGC_OUT_CTRL                   (0xa03c0c)
+
 /* FW chicken bits */
 #define LMPM_CHICK                      0xA01FF8
 enum {
diff --git a/drivers/net/wireless/iwlwifi/iwl-scd.h b/drivers/net/wireless/iwlwifi/iwl-scd.h
index 6c622b21bba7..f2353ebf2666 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scd.h
+++ b/drivers/net/wireless/iwlwifi/iwl-scd.h
@@ -69,14 +69,6 @@
 #include "iwl-prph.h"
 
 
-static inline void iwl_scd_txq_set_inactive(struct iwl_trans *trans,
-                                            u16 txq_id)
-{
-        iwl_write_prph(trans, SCD_QUEUE_STATUS_BITS(txq_id),
-                       (0 << SCD_QUEUE_STTS_REG_POS_ACTIVE)|
-                       (1 << SCD_QUEUE_STTS_REG_POS_SCD_ACT_EN));
-}
-
 static inline void iwl_scd_txq_set_chain(struct iwl_trans *trans,
                                          u16 txq_id)
 {
@@ -115,4 +107,37 @@ static inline void iwl_scd_enable_set_active(struct iwl_trans *trans,
 {
         iwl_write_prph(trans, SCD_EN_CTRL, value);
 }
+
+static inline unsigned int SCD_QUEUE_WRPTR(unsigned int chnl)
+{
+        if (chnl < 20)
+                return SCD_BASE + 0x18 + chnl * 4;
+        WARN_ON_ONCE(chnl >= 32);
+        return SCD_BASE + 0x284 + (chnl - 20) * 4;
+}
+
+static inline unsigned int SCD_QUEUE_RDPTR(unsigned int chnl)
+{
+        if (chnl < 20)
+                return SCD_BASE + 0x68 + chnl * 4;
+        WARN_ON_ONCE(chnl >= 32);
+        return SCD_BASE + 0x2B4 + chnl * 4;
+}
+
+static inline unsigned int SCD_QUEUE_STATUS_BITS(unsigned int chnl)
+{
+        if (chnl < 20)
+                return SCD_BASE + 0x10c + chnl * 4;
+        WARN_ON_ONCE(chnl >= 32);
+        return SCD_BASE + 0x334 + chnl * 4;
+}
+
+static inline void iwl_scd_txq_set_inactive(struct iwl_trans *trans,
+                                            u16 txq_id)
+{
+        iwl_write_prph(trans, SCD_QUEUE_STATUS_BITS(txq_id),
+                       (0 << SCD_QUEUE_STTS_REG_POS_ACTIVE)|
+                       (1 << SCD_QUEUE_STTS_REG_POS_SCD_ACT_EN));
+}
+
 #endif
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.h b/drivers/net/wireless/iwlwifi/iwl-trans.h
index 028408a6ecba..a96bd8db6ceb 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans.h
@@ -368,6 +368,7 @@ enum iwl_trans_status {
  * @cmd_queue: the index of the command queue.
  *      Must be set before start_fw.
  * @cmd_fifo: the fifo for host commands
+ * @cmd_q_wdg_timeout: the timeout of the watchdog timer for the command queue.
  * @no_reclaim_cmds: Some devices erroneously don't set the
  *      SEQ_RX_FRAME bit on some notifications, this is the
  *      list of such notifications to filter. Max length is
@@ -378,24 +379,26 @@ enum iwl_trans_status {
  * @bc_table_dword: set to true if the BC table expects the byte count to be
  *      in DWORD (as opposed to bytes)
  * @scd_set_active: should the transport configure the SCD for HCMD queue
- * @queue_watchdog_timeout: time (in ms) after which queues
- *      are considered stuck and will trigger device restart
  * @command_names: array of command names, must be 256 entries
  *      (one for each command); for debugging only
+ * @sdio_adma_addr: the default address to set for the ADMA in SDIO mode until
+ *      we get the ALIVE from the uCode
  */
 struct iwl_trans_config {
         struct iwl_op_mode *op_mode;
 
         u8 cmd_queue;
         u8 cmd_fifo;
+        unsigned int cmd_q_wdg_timeout;
         const u8 *no_reclaim_cmds;
         unsigned int n_no_reclaim_cmds;
 
         bool rx_buf_size_8k;
         bool bc_table_dword;
         bool scd_set_active;
-        unsigned int queue_watchdog_timeout;
         const char *const *command_names;
+
+        u32 sdio_adma_addr;
 };
 
 struct iwl_trans_dump_data {
@@ -507,7 +510,8 @@ struct iwl_trans_ops {
                         struct sk_buff_head *skbs);
 
         void (*txq_enable)(struct iwl_trans *trans, int queue, u16 ssn,
-                           const struct iwl_trans_txq_scd_cfg *cfg);
+                           const struct iwl_trans_txq_scd_cfg *cfg,
+                           unsigned int queue_wdg_timeout);
         void (*txq_disable)(struct iwl_trans *trans, int queue,
                             bool configure_scd);
 
@@ -552,6 +556,21 @@ enum iwl_trans_state {
 };
 
 /**
+ * enum iwl_d0i3_mode - d0i3 mode
+ *
+ * @IWL_D0I3_MODE_OFF - d0i3 is disabled
+ * @IWL_D0I3_MODE_ON_IDLE - enter d0i3 when device is idle
+ *      (e.g. no active references)
+ * @IWL_D0I3_MODE_ON_SUSPEND - enter d0i3 only on suspend
+ *      (in case of 'any' trigger)
+ */
+enum iwl_d0i3_mode {
+        IWL_D0I3_MODE_OFF = 0,
+        IWL_D0I3_MODE_ON_IDLE,
+        IWL_D0I3_MODE_ON_SUSPEND,
+};
+
+/**
  * struct iwl_trans - transport common data
  *
  * @ops - pointer to iwl_trans_ops
@@ -612,6 +631,8 @@ struct iwl_trans {
         const struct iwl_fw_dbg_conf_tlv *dbg_conf_tlv[FW_DBG_MAX];
         u8 dbg_dest_reg_num;
 
+        enum iwl_d0i3_mode d0i3_mode;
+
         /* pointer to trans specific struct */
         /*Ensure that this pointer will always be aligned to sizeof pointer */
         char trans_specific[0] __aligned(sizeof(void *));
@@ -808,19 +829,21 @@ static inline void iwl_trans_txq_disable(struct iwl_trans *trans, int queue,
 
 static inline void
 iwl_trans_txq_enable_cfg(struct iwl_trans *trans, int queue, u16 ssn,
-                         const struct iwl_trans_txq_scd_cfg *cfg)
+                         const struct iwl_trans_txq_scd_cfg *cfg,
+                         unsigned int queue_wdg_timeout)
 {
         might_sleep();
 
         if (unlikely((trans->state != IWL_TRANS_FW_ALIVE)))
                 IWL_ERR(trans, "%s bad state = %d\n", __func__, trans->state);
 
-        trans->ops->txq_enable(trans, queue, ssn, cfg);
+        trans->ops->txq_enable(trans, queue, ssn, cfg, queue_wdg_timeout);
 }
 
 static inline void iwl_trans_txq_enable(struct iwl_trans *trans, int queue,
                                         int fifo, int sta_id, int tid,
-                                        int frame_limit, u16 ssn)
+                                        int frame_limit, u16 ssn,
+                                        unsigned int queue_wdg_timeout)
 {
         struct iwl_trans_txq_scd_cfg cfg = {
                 .fifo = fifo,
@@ -830,11 +853,12 @@ static inline void iwl_trans_txq_enable(struct iwl_trans *trans, int queue,
                 .aggregate = sta_id >= 0,
         };
 
-        iwl_trans_txq_enable_cfg(trans, queue, ssn, &cfg);
+        iwl_trans_txq_enable_cfg(trans, queue, ssn, &cfg, queue_wdg_timeout);
 }
 
-static inline void iwl_trans_ac_txq_enable(struct iwl_trans *trans, int queue,
-                                           int fifo)
+static inline
+void iwl_trans_ac_txq_enable(struct iwl_trans *trans, int queue, int fifo,
+                             unsigned int queue_wdg_timeout)
 {
         struct iwl_trans_txq_scd_cfg cfg = {
                 .fifo = fifo,
@@ -844,16 +868,16 @@ static inline void iwl_trans_ac_txq_enable(struct iwl_trans *trans, int queue,
                 .aggregate = false,
         };
 
-        iwl_trans_txq_enable_cfg(trans, queue, 0, &cfg);
+        iwl_trans_txq_enable_cfg(trans, queue, 0, &cfg, queue_wdg_timeout);
 }
 
 static inline int iwl_trans_wait_tx_queue_empty(struct iwl_trans *trans,
-                                                u32 txq_bm)
+                                                u32 txqs)
 {
         if (unlikely(trans->state != IWL_TRANS_FW_ALIVE))
                 IWL_ERR(trans, "%s bad state = %d\n", __func__, trans->state);
 
-        return trans->ops->wait_tx_queue_empty(trans, txq_bm);
+        return trans->ops->wait_tx_queue_empty(trans, txqs);
 }
 
 static inline int iwl_trans_dbgfs_register(struct iwl_trans *trans,
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex.c b/drivers/net/wireless/iwlwifi/mvm/coex.c
index a3bfda45d9e6..1ec4d55155f7 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex.c
@@ -342,7 +342,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 12,
                 .lut20 = {
-                        cpu_to_le32(0x00000001),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -363,7 +363,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 20,
                 .lut20 = {
-                        cpu_to_le32(0x00000002),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -384,7 +384,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 21,
                 .lut20 = {
-                        cpu_to_le32(0x00000003),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -405,7 +405,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 23,
                 .lut20 = {
-                        cpu_to_le32(0x00000004),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -426,7 +426,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 27,
                 .lut20 = {
-                        cpu_to_le32(0x00000005),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -447,7 +447,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 30,
                 .lut20 = {
-                        cpu_to_le32(0x00000006),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -468,7 +468,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 32,
                 .lut20 = {
-                        cpu_to_le32(0x00000007),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -489,7 +489,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 33,
                 .lut20 = {
-                        cpu_to_le32(0x00000008),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -989,7 +989,7 @@ int iwl_mvm_rx_bt_coex_notif(struct iwl_mvm *mvm,
 static void iwl_mvm_bt_rssi_iterator(void *_data, u8 *mac,
                                    struct ieee80211_vif *vif)
 {
-        struct iwl_mvm_vif *mvmvif = (void *)vif->drv_priv;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_bt_iterator_data *data = _data;
         struct iwl_mvm *mvm = data->mvm;
 
@@ -1025,7 +1025,7 @@ static void iwl_mvm_bt_rssi_iterator(void *_data, u8 *mac,
 void iwl_mvm_bt_rssi_event(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                            enum ieee80211_rssi_event rssi_event)
 {
-        struct iwl_mvm_vif *mvmvif = (void *)vif->drv_priv;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_bt_iterator_data data = {
                 .mvm = mvm,
         };
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
index b3210cfbecc8..d530ef3da107 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
@@ -330,7 +330,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 12,
                 .lut20 = {
-                        cpu_to_le32(0x00000001),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -351,7 +351,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 20,
                 .lut20 = {
-                        cpu_to_le32(0x00000002),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -372,7 +372,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 21,
                 .lut20 = {
-                        cpu_to_le32(0x00000003),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -393,7 +393,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 23,
                 .lut20 = {
-                        cpu_to_le32(0x00000004),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -414,7 +414,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 27,
                 .lut20 = {
-                        cpu_to_le32(0x00000005),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -435,7 +435,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 30,
                 .lut20 = {
-                        cpu_to_le32(0x00000006),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -456,7 +456,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 32,
                 .lut20 = {
-                        cpu_to_le32(0x00000007),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -477,7 +477,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 33,
                 .lut20 = {
-                        cpu_to_le32(0x00000008),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -1034,7 +1034,7 @@ int iwl_mvm_rx_bt_coex_notif_old(struct iwl_mvm *mvm,
 static void iwl_mvm_bt_rssi_iterator(void *_data, u8 *mac,
                                      struct ieee80211_vif *vif)
 {
-        struct iwl_mvm_vif *mvmvif = (void *)vif->drv_priv;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_bt_iterator_data *data = _data;
         struct iwl_mvm *mvm = data->mvm;
 
@@ -1070,7 +1070,7 @@ static void iwl_mvm_bt_rssi_iterator(void *_data, u8 *mac,
 void iwl_mvm_bt_rssi_event_old(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                                enum ieee80211_rssi_event rssi_event)
 {
-        struct iwl_mvm_vif *mvmvif = (void *)vif->drv_priv;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_bt_iterator_data data = {
                 .mvm = mvm,
         };
diff --git a/drivers/net/wireless/iwlwifi/mvm/constants.h b/drivers/net/wireless/iwlwifi/mvm/constants.h
index 3bd93476ec1c..beba375489f1 100644
--- a/drivers/net/wireless/iwlwifi/mvm/constants.h
+++ b/drivers/net/wireless/iwlwifi/mvm/constants.h
@@ -94,13 +94,42 @@
 #define IWL_MVM_BT_COEX_MPLUT                   1
 #define IWL_MVM_BT_COEX_RRC                     1
 #define IWL_MVM_BT_COEX_TTC                     1
-#define IWL_MVM_BT_COEX_MPLUT_REG0              0x28412201
+#define IWL_MVM_BT_COEX_MPLUT_REG0              0x22002200
 #define IWL_MVM_BT_COEX_MPLUT_REG1              0x11118451
 #define IWL_MVM_BT_COEX_ANTENNA_COUPLING_THRS   30
 #define IWL_MVM_FW_MCAST_FILTER_PASS_ALL        0
 #define IWL_MVM_FW_BCAST_FILTER_PASS_ALL        0
-#define IWL_MVM_QUOTA_THRESHOLD                 8
+#define IWL_MVM_QUOTA_THRESHOLD                 4
 #define IWL_MVM_RS_RSSI_BASED_INIT_RATE         0
-#define IWL_MVM_RS_DISABLE_MIMO                 0
+#define IWL_MVM_RS_DISABLE_P2P_MIMO             0
+#define IWL_MVM_RS_NUM_TRY_BEFORE_ANT_TOGGLE    1
+#define IWL_MVM_RS_HT_VHT_RETRIES_PER_RATE      2
+#define IWL_MVM_RS_HT_VHT_RETRIES_PER_RATE_TW   1
+#define IWL_MVM_RS_INITIAL_MIMO_NUM_RATES       3
+#define IWL_MVM_RS_INITIAL_SISO_NUM_RATES       3
+#define IWL_MVM_RS_INITIAL_LEGACY_NUM_RATES     2
+#define IWL_MVM_RS_INITIAL_LEGACY_RETRIES       2
+#define IWL_MVM_RS_SECONDARY_LEGACY_RETRIES     1
+#define IWL_MVM_RS_SECONDARY_LEGACY_NUM_RATES   16
+#define IWL_MVM_RS_SECONDARY_SISO_NUM_RATES     3
+#define IWL_MVM_RS_SECONDARY_SISO_RETRIES       1
+#define IWL_MVM_RS_RATE_MIN_FAILURE_TH          3
+#define IWL_MVM_RS_RATE_MIN_SUCCESS_TH          8
+#define IWL_MVM_RS_STAY_IN_COLUMN_TIMEOUT       5       /* Seconds */
+#define IWL_MVM_RS_IDLE_TIMEOUT                 5       /* Seconds */
+#define IWL_MVM_RS_MISSED_RATE_MAX              15
+#define IWL_MVM_RS_LEGACY_FAILURE_LIMIT         160
+#define IWL_MVM_RS_LEGACY_SUCCESS_LIMIT         480
+#define IWL_MVM_RS_LEGACY_TABLE_COUNT           160
+#define IWL_MVM_RS_NON_LEGACY_FAILURE_LIMIT     400
+#define IWL_MVM_RS_NON_LEGACY_SUCCESS_LIMIT     4500
+#define IWL_MVM_RS_NON_LEGACY_TABLE_COUNT       1500
+#define IWL_MVM_RS_SR_FORCE_DECREASE            15      /* percent */
+#define IWL_MVM_RS_SR_NO_DECREASE               85      /* percent */
+#define IWL_MVM_RS_AGG_TIME_LIMIT               4000    /* 4 msecs. valid 100-8000 */
+#define IWL_MVM_RS_AGG_DISABLE_START            3
+#define IWL_MVM_RS_TPC_SR_FORCE_INCREASE        75      /* percent */
+#define IWL_MVM_RS_TPC_SR_NO_INCREASE           85      /* percent */
+#define IWL_MVM_RS_TPC_TX_POWER_STEP            3
 
 #endif /* __MVM_CONSTANTS_H */
diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c
index 744de262373e..14e8fd661889 100644
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -793,7 +793,7 @@ iwl_mvm_get_wowlan_config(struct iwl_mvm *mvm,
                           struct ieee80211_sta *ap_sta)
 {
         int ret;
-        struct iwl_mvm_sta *mvm_ap_sta = (struct iwl_mvm_sta *)ap_sta->drv_priv;
+        struct iwl_mvm_sta *mvm_ap_sta = iwl_mvm_sta_from_mac80211(ap_sta);
 
         /* TODO: wowlan_config_cmd->wowlan_ba_teardown_tids */
 
@@ -1137,12 +1137,43 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
         return ret;
 }
 
+static int iwl_mvm_enter_d0i3_sync(struct iwl_mvm *mvm)
+{
+        struct iwl_notification_wait wait_d3;
+        static const u8 d3_notif[] = { D3_CONFIG_CMD };
+        int ret;
+
+        iwl_init_notification_wait(&mvm->notif_wait, &wait_d3,
+                                   d3_notif, ARRAY_SIZE(d3_notif),
+                                   NULL, NULL);
+
+        ret = iwl_mvm_enter_d0i3(mvm->hw->priv);
+        if (ret)
+                goto remove_notif;
+
+        ret = iwl_wait_notification(&mvm->notif_wait, &wait_d3, HZ);
+        WARN_ON_ONCE(ret);
+        return ret;
+
+remove_notif:
+        iwl_remove_notification(&mvm->notif_wait, &wait_d3);
+        return ret;
+}
+
 int iwl_mvm_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 
         iwl_trans_suspend(mvm->trans);
-        if (iwl_mvm_is_d0i3_supported(mvm)) {
+        if (wowlan->any) {
+                /* 'any' trigger means d0i3 usage */
+                if (mvm->trans->d0i3_mode == IWL_D0I3_MODE_ON_SUSPEND) {
+                        int ret = iwl_mvm_enter_d0i3_sync(mvm);
+
+                        if (ret)
+                                return ret;
+                }
+
                 mutex_lock(&mvm->d0i3_suspend_mutex);
                 __set_bit(D0I3_DEFER_WAKEUP, &mvm->d0i3_suspend_flags);
                 mutex_unlock(&mvm->d0i3_suspend_mutex);
@@ -1626,7 +1657,7 @@ static bool iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
         if (IS_ERR_OR_NULL(ap_sta))
                 goto out_free;
 
-        mvm_ap_sta = (struct iwl_mvm_sta *)ap_sta->drv_priv;
+        mvm_ap_sta = iwl_mvm_sta_from_mac80211(ap_sta);
         for (i = 0; i < IWL_MAX_TID_COUNT; i++) {
                 u16 seq = status.qos_seq_ctr[i];
                 /* firmware stores last-used value, we store next value */
@@ -1876,8 +1907,20 @@ int iwl_mvm_resume(struct ieee80211_hw *hw)
 
         iwl_trans_resume(mvm->trans);
 
-        if (iwl_mvm_is_d0i3_supported(mvm))
+        if (mvm->hw->wiphy->wowlan_config->any) {
+                /* 'any' trigger means d0i3 usage */
+                if (mvm->trans->d0i3_mode == IWL_D0I3_MODE_ON_SUSPEND) {
+                        int ret = iwl_mvm_exit_d0i3(hw->priv);
+
+                        if (ret)
+                                return ret;
+                        /*
+                         * d0i3 exit will be deferred until reconfig_complete.
+                         * make sure there we are out of d0i3.
+                         */
+                }
                 return 0;
+        }
 
         return __iwl_mvm_resume(mvm, false);
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c b/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c
index 9aa2311a776c..5fe14591e1c4 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c
@@ -268,7 +268,7 @@ static ssize_t iwl_dbgfs_mac_params_read(struct file *file,
                 sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[ap_sta_id],
                                                 lockdep_is_held(&mvm->mutex));
                 if (!IS_ERR_OR_NULL(sta)) {
-                        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+                        struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
 
                         pos += scnprintf(buf+pos, bufsz-pos,
                                          "ap_sta_id %d - reduced Tx power %d\n",
@@ -517,6 +517,34 @@ static ssize_t iwl_dbgfs_low_latency_read(struct file *file,
         return simple_read_from_buffer(user_buf, count, ppos, buf, sizeof(buf));
 }
 
+static ssize_t iwl_dbgfs_uapsd_misbehaving_read(struct file *file,
+                                                char __user *user_buf,
+                                                size_t count, loff_t *ppos)
+{
+        struct ieee80211_vif *vif = file->private_data;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        char buf[20];
+        int len;
+
+        len = sprintf(buf, "%pM\n", mvmvif->uapsd_misbehaving_bssid);
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t iwl_dbgfs_uapsd_misbehaving_write(struct ieee80211_vif *vif,
+                                                 char *buf, size_t count,
+                                                 loff_t *ppos)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct iwl_mvm *mvm = mvmvif->mvm;
+        bool ret;
+
+        mutex_lock(&mvm->mutex);
+        ret = mac_pton(buf, mvmvif->uapsd_misbehaving_bssid);
+        mutex_unlock(&mvm->mutex);
+
+        return ret ? count : -EINVAL;
+}
+
 #define MVM_DEBUGFS_WRITE_FILE_OPS(name, bufsz) \
         _MVM_DEBUGFS_WRITE_FILE_OPS(name, bufsz, struct ieee80211_vif)
 #define MVM_DEBUGFS_READ_WRITE_FILE_OPS(name, bufsz) \
@@ -531,6 +559,7 @@ MVM_DEBUGFS_READ_FILE_OPS(mac_params);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(pm_params, 32);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(bf_params, 256);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(low_latency, 10);
+MVM_DEBUGFS_READ_WRITE_FILE_OPS(uapsd_misbehaving, 20);
 
 void iwl_mvm_vif_dbgfs_register(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 {
@@ -564,6 +593,8 @@ void iwl_mvm_vif_dbgfs_register(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
         MVM_DEBUGFS_ADD_FILE_VIF(mac_params, mvmvif->dbgfs_dir, S_IRUSR);
         MVM_DEBUGFS_ADD_FILE_VIF(low_latency, mvmvif->dbgfs_dir,
                                  S_IRUSR | S_IWUSR);
+        MVM_DEBUGFS_ADD_FILE_VIF(uapsd_misbehaving, mvmvif->dbgfs_dir,
+                                 S_IRUSR | S_IWUSR);
 
         if (vif->type == NL80211_IFTYPE_STATION && !vif->p2p &&
             mvmvif == mvm->bf_allowed_vif)
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
index 33bf915cd7ea..82c09d86af8c 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
@@ -654,10 +654,10 @@ out:
         return ret ?: count;
 }
 
-#define PRINT_STATS_LE32(_str, _val)                                    \
+#define PRINT_STATS_LE32(_struct, _memb)                                \
                          pos += scnprintf(buf + pos, bufsz - pos,       \
-                                          fmt_table, _str,              \
-                                          le32_to_cpu(_val))
+                                          fmt_table, #_memb,            \
+                                          le32_to_cpu(_struct->_memb))
 
 static ssize_t iwl_dbgfs_fw_rx_stats_read(struct file *file,
                                           char __user *user_buf, size_t count,
@@ -692,97 +692,89 @@ static ssize_t iwl_dbgfs_fw_rx_stats_read(struct file *file,
 
         pos += scnprintf(buf + pos, bufsz - pos, fmt_header,
                          "Statistics_Rx - OFDM");
-        PRINT_STATS_LE32("ina_cnt", ofdm->ina_cnt);
-        PRINT_STATS_LE32("fina_cnt", ofdm->fina_cnt);
-        PRINT_STATS_LE32("plcp_err", ofdm->plcp_err);
-        PRINT_STATS_LE32("crc32_err", ofdm->crc32_err);
-        PRINT_STATS_LE32("overrun_err", ofdm->overrun_err);
-        PRINT_STATS_LE32("early_overrun_err", ofdm->early_overrun_err);
-        PRINT_STATS_LE32("crc32_good", ofdm->crc32_good);
-        PRINT_STATS_LE32("false_alarm_cnt", ofdm->false_alarm_cnt);
-        PRINT_STATS_LE32("fina_sync_err_cnt", ofdm->fina_sync_err_cnt);
-        PRINT_STATS_LE32("sfd_timeout", ofdm->sfd_timeout);
-        PRINT_STATS_LE32("fina_timeout", ofdm->fina_timeout);
-        PRINT_STATS_LE32("unresponded_rts", ofdm->unresponded_rts);
-        PRINT_STATS_LE32("rxe_frame_lmt_overrun",
-                         ofdm->rxe_frame_limit_overrun);
-        PRINT_STATS_LE32("sent_ack_cnt", ofdm->sent_ack_cnt);
-        PRINT_STATS_LE32("sent_cts_cnt", ofdm->sent_cts_cnt);
-        PRINT_STATS_LE32("sent_ba_rsp_cnt", ofdm->sent_ba_rsp_cnt);
-        PRINT_STATS_LE32("dsp_self_kill", ofdm->dsp_self_kill);
-        PRINT_STATS_LE32("mh_format_err", ofdm->mh_format_err);
-        PRINT_STATS_LE32("re_acq_main_rssi_sum", ofdm->re_acq_main_rssi_sum);
-        PRINT_STATS_LE32("reserved", ofdm->reserved);
+        PRINT_STATS_LE32(ofdm, ina_cnt);
+        PRINT_STATS_LE32(ofdm, fina_cnt);
+        PRINT_STATS_LE32(ofdm, plcp_err);
+        PRINT_STATS_LE32(ofdm, crc32_err);
+        PRINT_STATS_LE32(ofdm, overrun_err);
+        PRINT_STATS_LE32(ofdm, early_overrun_err);
+        PRINT_STATS_LE32(ofdm, crc32_good);
+        PRINT_STATS_LE32(ofdm, false_alarm_cnt);
+        PRINT_STATS_LE32(ofdm, fina_sync_err_cnt);
+        PRINT_STATS_LE32(ofdm, sfd_timeout);
+        PRINT_STATS_LE32(ofdm, fina_timeout);
+        PRINT_STATS_LE32(ofdm, unresponded_rts);
+        PRINT_STATS_LE32(ofdm, rxe_frame_lmt_overrun);
+        PRINT_STATS_LE32(ofdm, sent_ack_cnt);
+        PRINT_STATS_LE32(ofdm, sent_cts_cnt);
+        PRINT_STATS_LE32(ofdm, sent_ba_rsp_cnt);
+        PRINT_STATS_LE32(ofdm, dsp_self_kill);
+        PRINT_STATS_LE32(ofdm, mh_format_err);
+        PRINT_STATS_LE32(ofdm, re_acq_main_rssi_sum);
+        PRINT_STATS_LE32(ofdm, reserved);
 
         pos += scnprintf(buf + pos, bufsz - pos, fmt_header,
                          "Statistics_Rx - CCK");
-        PRINT_STATS_LE32("ina_cnt", cck->ina_cnt);
-        PRINT_STATS_LE32("fina_cnt", cck->fina_cnt);
-        PRINT_STATS_LE32("plcp_err", cck->plcp_err);
-        PRINT_STATS_LE32("crc32_err", cck->crc32_err);
-        PRINT_STATS_LE32("overrun_err", cck->overrun_err);
-        PRINT_STATS_LE32("early_overrun_err", cck->early_overrun_err);
-        PRINT_STATS_LE32("crc32_good", cck->crc32_good);
-        PRINT_STATS_LE32("false_alarm_cnt", cck->false_alarm_cnt);
-        PRINT_STATS_LE32("fina_sync_err_cnt", cck->fina_sync_err_cnt);
-        PRINT_STATS_LE32("sfd_timeout", cck->sfd_timeout);
-        PRINT_STATS_LE32("fina_timeout", cck->fina_timeout);
-        PRINT_STATS_LE32("unresponded_rts", cck->unresponded_rts);
-        PRINT_STATS_LE32("rxe_frame_lmt_overrun",
-                         cck->rxe_frame_limit_overrun);
-        PRINT_STATS_LE32("sent_ack_cnt", cck->sent_ack_cnt);
-        PRINT_STATS_LE32("sent_cts_cnt", cck->sent_cts_cnt);
-        PRINT_STATS_LE32("sent_ba_rsp_cnt", cck->sent_ba_rsp_cnt);
-        PRINT_STATS_LE32("dsp_self_kill", cck->dsp_self_kill);
-        PRINT_STATS_LE32("mh_format_err", cck->mh_format_err);
-        PRINT_STATS_LE32("re_acq_main_rssi_sum", cck->re_acq_main_rssi_sum);
-        PRINT_STATS_LE32("reserved", cck->reserved);
+        PRINT_STATS_LE32(cck, ina_cnt);
+        PRINT_STATS_LE32(cck, fina_cnt);
+        PRINT_STATS_LE32(cck, plcp_err);
+        PRINT_STATS_LE32(cck, crc32_err);
+        PRINT_STATS_LE32(cck, overrun_err);
+        PRINT_STATS_LE32(cck, early_overrun_err);
+        PRINT_STATS_LE32(cck, crc32_good);
+        PRINT_STATS_LE32(cck, false_alarm_cnt);
+        PRINT_STATS_LE32(cck, fina_sync_err_cnt);
+        PRINT_STATS_LE32(cck, sfd_timeout);
+        PRINT_STATS_LE32(cck, fina_timeout);
+        PRINT_STATS_LE32(cck, unresponded_rts);
+        PRINT_STATS_LE32(cck, rxe_frame_lmt_overrun);
+        PRINT_STATS_LE32(cck, sent_ack_cnt);
+        PRINT_STATS_LE32(cck, sent_cts_cnt);
+        PRINT_STATS_LE32(cck, sent_ba_rsp_cnt);
+        PRINT_STATS_LE32(cck, dsp_self_kill);
+        PRINT_STATS_LE32(cck, mh_format_err);
+        PRINT_STATS_LE32(cck, re_acq_main_rssi_sum);
+        PRINT_STATS_LE32(cck, reserved);
 
         pos += scnprintf(buf + pos, bufsz - pos, fmt_header,
                          "Statistics_Rx - GENERAL");
-        PRINT_STATS_LE32("bogus_cts", general->bogus_cts);
-        PRINT_STATS_LE32("bogus_ack", general->bogus_ack);
-        PRINT_STATS_LE32("non_bssid_frames", general->non_bssid_frames);
-        PRINT_STATS_LE32("filtered_frames", general->filtered_frames);
-        PRINT_STATS_LE32("non_channel_beacons", general->non_channel_beacons);
-        PRINT_STATS_LE32("channel_beacons", general->channel_beacons);
-        PRINT_STATS_LE32("num_missed_bcon", general->num_missed_bcon);
-        PRINT_STATS_LE32("adc_rx_saturation_time",
-                         general->adc_rx_saturation_time);
-        PRINT_STATS_LE32("ina_detection_search_time",
-                         general->ina_detection_search_time);
-        PRINT_STATS_LE32("beacon_silence_rssi_a",
-                         general->beacon_silence_rssi_a);
-        PRINT_STATS_LE32("beacon_silence_rssi_b",
-                         general->beacon_silence_rssi_b);
-        PRINT_STATS_LE32("beacon_silence_rssi_c",
-                         general->beacon_silence_rssi_c);
-        PRINT_STATS_LE32("interference_data_flag",
-                         general->interference_data_flag);
-        PRINT_STATS_LE32("channel_load", general->channel_load);
-        PRINT_STATS_LE32("dsp_false_alarms", general->dsp_false_alarms);
-        PRINT_STATS_LE32("beacon_rssi_a", general->beacon_rssi_a);
-        PRINT_STATS_LE32("beacon_rssi_b", general->beacon_rssi_b);
-        PRINT_STATS_LE32("beacon_rssi_c", general->beacon_rssi_c);
-        PRINT_STATS_LE32("beacon_energy_a", general->beacon_energy_a);
-        PRINT_STATS_LE32("beacon_energy_b", general->beacon_energy_b);
-        PRINT_STATS_LE32("beacon_energy_c", general->beacon_energy_c);
-        PRINT_STATS_LE32("num_bt_kills", general->num_bt_kills);
-        PRINT_STATS_LE32("mac_id", general->mac_id);
-        PRINT_STATS_LE32("directed_data_mpdu", general->directed_data_mpdu);
+        PRINT_STATS_LE32(general, bogus_cts);
+        PRINT_STATS_LE32(general, bogus_ack);
+        PRINT_STATS_LE32(general, non_bssid_frames);
+        PRINT_STATS_LE32(general, filtered_frames);
+        PRINT_STATS_LE32(general, non_channel_beacons);
+        PRINT_STATS_LE32(general, channel_beacons);
+        PRINT_STATS_LE32(general, num_missed_bcon);
+        PRINT_STATS_LE32(general, adc_rx_saturation_time);
+        PRINT_STATS_LE32(general, ina_detection_search_time);
+        PRINT_STATS_LE32(general, beacon_silence_rssi_a);
+        PRINT_STATS_LE32(general, beacon_silence_rssi_b);
+        PRINT_STATS_LE32(general, beacon_silence_rssi_c);
+        PRINT_STATS_LE32(general, interference_data_flag);
+        PRINT_STATS_LE32(general, channel_load);
+        PRINT_STATS_LE32(general, dsp_false_alarms);
+        PRINT_STATS_LE32(general, beacon_rssi_a);
+        PRINT_STATS_LE32(general, beacon_rssi_b);
+        PRINT_STATS_LE32(general, beacon_rssi_c);
+        PRINT_STATS_LE32(general, beacon_energy_a);
+        PRINT_STATS_LE32(general, beacon_energy_b);
+        PRINT_STATS_LE32(general, beacon_energy_c);
+        PRINT_STATS_LE32(general, num_bt_kills);
+        PRINT_STATS_LE32(general, mac_id);
+        PRINT_STATS_LE32(general, directed_data_mpdu);
 
         pos += scnprintf(buf + pos, bufsz - pos, fmt_header,
                          "Statistics_Rx - HT");
-        PRINT_STATS_LE32("plcp_err", ht->plcp_err);
-        PRINT_STATS_LE32("overrun_err", ht->overrun_err);
-        PRINT_STATS_LE32("early_overrun_err", ht->early_overrun_err);
-        PRINT_STATS_LE32("crc32_good", ht->crc32_good);
-        PRINT_STATS_LE32("crc32_err", ht->crc32_err);
-        PRINT_STATS_LE32("mh_format_err", ht->mh_format_err);
-        PRINT_STATS_LE32("agg_crc32_good", ht->agg_crc32_good);
-        PRINT_STATS_LE32("agg_mpdu_cnt", ht->agg_mpdu_cnt);
-        PRINT_STATS_LE32("agg_cnt", ht->agg_cnt);
-        PRINT_STATS_LE32("unsupport_mcs", ht->unsupport_mcs);
+        PRINT_STATS_LE32(ht, plcp_err);
+        PRINT_STATS_LE32(ht, overrun_err);
+        PRINT_STATS_LE32(ht, early_overrun_err);
+        PRINT_STATS_LE32(ht, crc32_good);
+        PRINT_STATS_LE32(ht, crc32_err);
+        PRINT_STATS_LE32(ht, mh_format_err);
+        PRINT_STATS_LE32(ht, agg_crc32_good);
+        PRINT_STATS_LE32(ht, agg_mpdu_cnt);
+        PRINT_STATS_LE32(ht, agg_cnt);
+        PRINT_STATS_LE32(ht, unsupport_mcs);
 
         mutex_unlock(&mvm->mutex);
 
@@ -933,7 +925,7 @@ iwl_dbgfs_scan_ant_rxchain_write(struct iwl_mvm *mvm, char *buf,
                 return -EINVAL;
         if (scan_rx_ant > ANT_ABC)
                 return -EINVAL;
-        if (scan_rx_ant & ~mvm->fw->valid_rx_ant)
+        if (scan_rx_ant & ~(iwl_mvm_get_valid_rx_ant(mvm)))
                 return -EINVAL;
 
         if (mvm->scan_rx_ant != scan_rx_ant) {
@@ -945,6 +937,61 @@ iwl_dbgfs_scan_ant_rxchain_write(struct iwl_mvm *mvm, char *buf,
         return count;
 }
 
+static ssize_t iwl_dbgfs_fw_dbg_conf_read(struct file *file,
+                                          char __user *user_buf,
+                                          size_t count, loff_t *ppos)
+{
+        struct iwl_mvm *mvm = file->private_data;
+        enum iwl_fw_dbg_conf conf;
+        char buf[8];
+        const size_t bufsz = sizeof(buf);
+        int pos = 0;
+
+        mutex_lock(&mvm->mutex);
+        conf = mvm->fw_dbg_conf;
+        mutex_unlock(&mvm->mutex);
+
+        pos += scnprintf(buf + pos, bufsz - pos, "%d\n", conf);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+}
+
+static ssize_t iwl_dbgfs_fw_dbg_conf_write(struct iwl_mvm *mvm,
+                                           char *buf, size_t count,
+                                           loff_t *ppos)
+{
+        int ret, conf_id;
+
+        ret = kstrtoint(buf, 0, &conf_id);
+        if (ret)
+                return ret;
+
+        if (WARN_ON(conf_id >= FW_DBG_MAX))
+                return -EINVAL;
+
+        mutex_lock(&mvm->mutex);
+        ret = iwl_mvm_start_fw_dbg_conf(mvm, conf_id);
+        mutex_unlock(&mvm->mutex);
+
+        return ret ?: count;
+}
+
+static ssize_t iwl_dbgfs_fw_dbg_collect_write(struct iwl_mvm *mvm,
+                                              char *buf, size_t count,
+                                              loff_t *ppos)
+{
+        int ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_PRPH_WRITE);
+
+        if (ret)
+                return ret;
+
+        iwl_mvm_fw_dbg_collect(mvm);
+
+        iwl_mvm_unref(mvm, IWL_MVM_REF_PRPH_WRITE);
+
+        return count;
+}
+
 #define ADD_TEXT(...) pos += scnprintf(buf + pos, bufsz - pos, __VA_ARGS__)
 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
 static ssize_t iwl_dbgfs_bcast_filters_read(struct file *file,
@@ -1340,6 +1387,7 @@ static ssize_t iwl_dbgfs_d0i3_refs_read(struct file *file,
         PRINT_MVM_REF(IWL_MVM_REF_TM_CMD);
         PRINT_MVM_REF(IWL_MVM_REF_EXIT_WORK);
         PRINT_MVM_REF(IWL_MVM_REF_PROTECT_CSA);
+        PRINT_MVM_REF(IWL_MVM_REF_FW_DBG_COLLECT);
 
         return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
@@ -1439,6 +1487,26 @@ out:
         return count;
 }
 
+static ssize_t iwl_dbgfs_enable_scan_iteration_notif_write(struct iwl_mvm *mvm,
+                                                           char *buf,
+                                                           size_t count,
+                                                           loff_t *ppos)
+{
+        int val;
+
+        mutex_lock(&mvm->mutex);
+
+        if (kstrtoint(buf, 10, &val)) {
+                mutex_unlock(&mvm->mutex);
+                return -EINVAL;
+        }
+
+        mvm->scan_iter_notif_enabled = val;
+        mutex_unlock(&mvm->mutex);
+
+        return count;
+}
+
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(prph_reg, 64);
 
 /* Device wide debugfs entries */
@@ -1459,6 +1527,9 @@ MVM_DEBUGFS_WRITE_FILE_OPS(bt_tx_prio, 10);
 MVM_DEBUGFS_WRITE_FILE_OPS(bt_force_ant, 10);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(scan_ant_rxchain, 8);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(d0i3_refs, 8);
+MVM_DEBUGFS_READ_WRITE_FILE_OPS(fw_dbg_conf, 8);
+MVM_DEBUGFS_WRITE_FILE_OPS(fw_dbg_collect, 8);
+MVM_DEBUGFS_WRITE_FILE_OPS(enable_scan_iteration_notif, 8);
 
 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(bcast_filters, 256);
@@ -1500,6 +1571,10 @@ int iwl_mvm_dbgfs_register(struct iwl_mvm *mvm, struct dentry *dbgfs_dir)
                              S_IWUSR | S_IRUSR);
         MVM_DEBUGFS_ADD_FILE(prph_reg, mvm->debugfs_dir, S_IWUSR | S_IRUSR);
         MVM_DEBUGFS_ADD_FILE(d0i3_refs, mvm->debugfs_dir, S_IRUSR | S_IWUSR);
+        MVM_DEBUGFS_ADD_FILE(fw_dbg_conf, mvm->debugfs_dir, S_IRUSR | S_IWUSR);
+        MVM_DEBUGFS_ADD_FILE(fw_dbg_collect, mvm->debugfs_dir, S_IWUSR);
+        MVM_DEBUGFS_ADD_FILE(enable_scan_iteration_notif, mvm->debugfs_dir,
+                             S_IWUSR);
 
 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
         if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_BCAST_FILTERING) {
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
index 430020047b77..4fc0938b3fb6 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
@@ -92,14 +92,32 @@ enum iwl_ltr_config_flags {
 };
 
 /**
+ * struct iwl_ltr_config_cmd_v1 - configures the LTR
+ * @flags: See %enum iwl_ltr_config_flags
+ */
+struct iwl_ltr_config_cmd_v1 {
+        __le32 flags;
+        __le32 static_long;
+        __le32 static_short;
+} __packed; /* LTR_CAPABLE_API_S_VER_1 */
+
+#define LTR_VALID_STATES_NUM 4
+
+/**
  * struct iwl_ltr_config_cmd - configures the LTR
  * @flags: See %enum iwl_ltr_config_flags
+ * @static_long:
+ * @static_short:
+ * @ltr_cfg_values:
+ * @ltr_short_idle_timeout:
  */
 struct iwl_ltr_config_cmd {
         __le32 flags;
         __le32 static_long;
         __le32 static_short;
-} __packed;
+        __le32 ltr_cfg_values[LTR_VALID_STATES_NUM];
+        __le32 ltr_short_idle_timeout;
+} __packed; /* LTR_CAPABLE_API_S_VER_2 */
 
 /* Radio LP RX Energy Threshold measured in dBm */
 #define POWER_LPRX_RSSI_THRESHOLD       75
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-rs.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-rs.h
index 8bb5b94bf963..0f1ea80a55ef 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-rs.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-rs.h
@@ -308,6 +308,42 @@ enum {
 #define LQ_FLAG_DYNAMIC_BW_POS          6
 #define LQ_FLAG_DYNAMIC_BW_MSK          (1 << LQ_FLAG_DYNAMIC_BW_POS)
 
+/* Single Stream Tx Parameters (lq_cmd->ss_params)
+ * Flags to control a smart FW decision about whether BFER/STBC/SISO will be
+ * used for single stream Tx.
+ */
+
+/* Bit 0-1: Max STBC streams allowed. Can be 0-3.
+ * (0) - No STBC allowed
+ * (1) - 2x1 STBC allowed (HT/VHT)
+ * (2) - 4x2 STBC allowed (HT/VHT)
+ * (3) - 3x2 STBC allowed (HT only)
+ * All our chips are at most 2 antennas so only (1) is valid for now.
+ */
+#define LQ_SS_STBC_ALLOWED_POS          0
+#define LQ_SS_STBC_ALLOWED_MSK          (3 << LQ_SS_STBC_ALLOWED_MSK)
+
+/* 2x1 STBC is allowed */
+#define LQ_SS_STBC_1SS_ALLOWED          (1 << LQ_SS_STBC_ALLOWED_POS)
+
+/* Bit 2: Beamformer (VHT only) is allowed */
+#define LQ_SS_BFER_ALLOWED_POS          2
+#define LQ_SS_BFER_ALLOWED              (1 << LQ_SS_BFER_ALLOWED_POS)
+
+/* Bit 3: Force BFER or STBC for testing
+ * If this is set:
+ * If BFER is allowed then force the ucode to choose BFER else
+ * If STBC is allowed then force the ucode to choose STBC over SISO
+ */
+#define LQ_SS_FORCE_POS                 3
+#define LQ_SS_FORCE                     (1 << LQ_SS_FORCE_POS)
+
+/* Bit 31: ss_params field is valid. Used for FW backward compatibility
+ * with other drivers which don't support the ss_params API yet
+ */
+#define LQ_SS_PARAMS_VALID_POS          31
+#define LQ_SS_PARAMS_VALID              (1 << LQ_SS_PARAMS_VALID_POS)
+
 /**
  * struct iwl_lq_cmd - link quality command
  * @sta_id: station to update
@@ -330,7 +366,7 @@ enum {
  *      2 - 0x3f: maximal number of frames (up to 3f == 63)
  * @rs_table: array of rates for each TX try, each is rate_n_flags,
  *      meaning it is a combination of RATE_MCS_* and IWL_RATE_*_PLCP
- * @bf_params: beam forming params, currently not used
+ * @ss_params: single stream features. declare whether STBC or BFER are allowed.
  */
 struct iwl_lq_cmd {
         u8 sta_id;
@@ -348,6 +384,6 @@ struct iwl_lq_cmd {
         u8 agg_frame_cnt_limit;
         __le32 reserved2;
         __le32 rs_table[LQ_MAX_RETRY_NUM];
-        __le32 bf_params;
+        __le32 ss_params;
 }; /* LINK_QUALITY_CMD_API_S_VER_1 */
 #endif /* __fw_api_rs_h__ */
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-stats.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-stats.h
new file mode 100644
index 000000000000..928168b18346
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-stats.h
@@ -0,0 +1,277 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called COPYING.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#ifndef __fw_api_stats_h__
+#define __fw_api_stats_h__
+
+struct mvm_statistics_dbg {
+        __le32 burst_check;
+        __le32 burst_count;
+        __le32 wait_for_silence_timeout_cnt;
+        __le32 reserved[3];
+} __packed; /* STATISTICS_DEBUG_API_S_VER_2 */
+
+struct mvm_statistics_div {
+        __le32 tx_on_a;
+        __le32 tx_on_b;
+        __le32 exec_time;
+        __le32 probe_time;
+        __le32 rssi_ant;
+        __le32 reserved2;
+} __packed; /* STATISTICS_SLOW_DIV_API_S_VER_2 */
+
+struct mvm_statistics_rx_non_phy {
+        __le32 bogus_cts;       /* CTS received when not expecting CTS */
+        __le32 bogus_ack;       /* ACK received when not expecting ACK */
+        __le32 non_bssid_frames;        /* number of frames with BSSID that
+                                         * doesn't belong to the STA BSSID */
+        __le32 filtered_frames; /* count frames that were dumped in the
+                                 * filtering process */
+        __le32 non_channel_beacons;     /* beacons with our bss id but not on
+                                         * our serving channel */
+        __le32 channel_beacons; /* beacons with our bss id and in our
+                                 * serving channel */
+        __le32 num_missed_bcon; /* number of missed beacons */
+        __le32 adc_rx_saturation_time;  /* count in 0.8us units the time the
+                                         * ADC was in saturation */
+        __le32 ina_detection_search_time;/* total time (in 0.8us) searched
+                                          * for INA */
+        __le32 beacon_silence_rssi_a;   /* RSSI silence after beacon frame */
+        __le32 beacon_silence_rssi_b;   /* RSSI silence after beacon frame */
+        __le32 beacon_silence_rssi_c;   /* RSSI silence after beacon frame */
+        __le32 interference_data_flag;  /* flag for interference data
+                                         * availability. 1 when data is
+                                         * available. */
+        __le32 channel_load;            /* counts RX Enable time in uSec */
+        __le32 dsp_false_alarms;        /* DSP false alarm (both OFDM
+                                         * and CCK) counter */
+        __le32 beacon_rssi_a;
+        __le32 beacon_rssi_b;
+        __le32 beacon_rssi_c;
+        __le32 beacon_energy_a;
+        __le32 beacon_energy_b;
+        __le32 beacon_energy_c;
+        __le32 num_bt_kills;
+        __le32 mac_id;
+        __le32 directed_data_mpdu;
+} __packed; /* STATISTICS_RX_NON_PHY_API_S_VER_3 */
+
+struct mvm_statistics_rx_phy {
+        __le32 ina_cnt;
+        __le32 fina_cnt;
+        __le32 plcp_err;
+        __le32 crc32_err;
+        __le32 overrun_err;
+        __le32 early_overrun_err;
+        __le32 crc32_good;
+        __le32 false_alarm_cnt;
+        __le32 fina_sync_err_cnt;
+        __le32 sfd_timeout;
+        __le32 fina_timeout;
+        __le32 unresponded_rts;
+        __le32 rxe_frame_lmt_overrun;
+        __le32 sent_ack_cnt;
+        __le32 sent_cts_cnt;
+        __le32 sent_ba_rsp_cnt;
+        __le32 dsp_self_kill;
+        __le32 mh_format_err;
+        __le32 re_acq_main_rssi_sum;
+        __le32 reserved;
+} __packed; /* STATISTICS_RX_PHY_API_S_VER_2 */
+
+struct mvm_statistics_rx_ht_phy {
+        __le32 plcp_err;
+        __le32 overrun_err;
+        __le32 early_overrun_err;
+        __le32 crc32_good;
+        __le32 crc32_err;
+        __le32 mh_format_err;
+        __le32 agg_crc32_good;
+        __le32 agg_mpdu_cnt;
+        __le32 agg_cnt;
+        __le32 unsupport_mcs;
+} __packed;  /* STATISTICS_HT_RX_PHY_API_S_VER_1 */
+
+struct mvm_statistics_tx_non_phy {
+        __le32 preamble_cnt;
+        __le32 rx_detected_cnt;
+        __le32 bt_prio_defer_cnt;
+        __le32 bt_prio_kill_cnt;
+        __le32 few_bytes_cnt;
+        __le32 cts_timeout;
+        __le32 ack_timeout;
+        __le32 expected_ack_cnt;
+        __le32 actual_ack_cnt;
+        __le32 dump_msdu_cnt;
+        __le32 burst_abort_next_frame_mismatch_cnt;
+        __le32 burst_abort_missing_next_frame_cnt;
+        __le32 cts_timeout_collision;
+        __le32 ack_or_ba_timeout_collision;
+} __packed; /* STATISTICS_TX_NON_PHY_API_S_VER_3 */
+
+#define MAX_CHAINS 3
+
+struct mvm_statistics_tx_non_phy_agg {
+        __le32 ba_timeout;
+        __le32 ba_reschedule_frames;
+        __le32 scd_query_agg_frame_cnt;
+        __le32 scd_query_no_agg;
+        __le32 scd_query_agg;
+        __le32 scd_query_mismatch;
+        __le32 frame_not_ready;
+        __le32 underrun;
+        __le32 bt_prio_kill;
+        __le32 rx_ba_rsp_cnt;
+        __s8 txpower[MAX_CHAINS];
+        __s8 reserved;
+        __le32 reserved2;
+} __packed; /* STATISTICS_TX_NON_PHY_AGG_API_S_VER_1 */
+
+struct mvm_statistics_tx_channel_width {
+        __le32 ext_cca_narrow_ch20[1];
+        __le32 ext_cca_narrow_ch40[2];
+        __le32 ext_cca_narrow_ch80[3];
+        __le32 ext_cca_narrow_ch160[4];
+        __le32 last_tx_ch_width_indx;
+        __le32 rx_detected_per_ch_width[4];
+        __le32 success_per_ch_width[4];
+        __le32 fail_per_ch_width[4];
+}; /* STATISTICS_TX_CHANNEL_WIDTH_API_S_VER_1 */
+
+struct mvm_statistics_tx {
+        struct mvm_statistics_tx_non_phy general;
+        struct mvm_statistics_tx_non_phy_agg agg;
+        struct mvm_statistics_tx_channel_width channel_width;
+} __packed; /* STATISTICS_TX_API_S_VER_4 */
+
+
+struct mvm_statistics_bt_activity {
+        __le32 hi_priority_tx_req_cnt;
+        __le32 hi_priority_tx_denied_cnt;
+        __le32 lo_priority_tx_req_cnt;
+        __le32 lo_priority_tx_denied_cnt;
+        __le32 hi_priority_rx_req_cnt;
+        __le32 hi_priority_rx_denied_cnt;
+        __le32 lo_priority_rx_req_cnt;
+        __le32 lo_priority_rx_denied_cnt;
+} __packed;  /* STATISTICS_BT_ACTIVITY_API_S_VER_1 */
+
+struct mvm_statistics_general {
+        __le32 radio_temperature;
+        __le32 radio_voltage;
+        struct mvm_statistics_dbg dbg;
+        __le32 sleep_time;
+        __le32 slots_out;
+        __le32 slots_idle;
+        __le32 ttl_timestamp;
+        struct mvm_statistics_div slow_div;
+        __le32 rx_enable_counter;
+        /*
+         * num_of_sos_states:
+         *  count the number of times we have to re-tune
+         *  in order to get out of bad PHY status
+         */
+        __le32 num_of_sos_states;
+        __le32 beacon_filtered;
+        __le32 missed_beacons;
+        __s8 beacon_filter_average_energy;
+        __s8 beacon_filter_reason;
+        __s8 beacon_filter_current_energy;
+        __s8 beacon_filter_reserved;
+        __le32 beacon_filter_delta_time;
+        struct mvm_statistics_bt_activity bt_activity;
+} __packed; /* STATISTICS_GENERAL_API_S_VER_5 */
+
+struct mvm_statistics_rx {
+        struct mvm_statistics_rx_phy ofdm;
+        struct mvm_statistics_rx_phy cck;
+        struct mvm_statistics_rx_non_phy general;
+        struct mvm_statistics_rx_ht_phy ofdm_ht;
+} __packed; /* STATISTICS_RX_API_S_VER_3 */
+
+/*
+ * STATISTICS_NOTIFICATION = 0x9d (notification only, not a command)
+ *
+ * By default, uCode issues this notification after receiving a beacon
+ * while associated.  To disable this behavior, set DISABLE_NOTIF flag in the
+ * REPLY_STATISTICS_CMD 0x9c, above.
+ *
+ * Statistics counters continue to increment beacon after beacon, but are
+ * cleared when changing channels or when driver issues REPLY_STATISTICS_CMD
+ * 0x9c with CLEAR_STATS bit set (see above).
+ *
+ * uCode also issues this notification during scans.  uCode clears statistics
+ * appropriately so that each notification contains statistics for only the
+ * one channel that has just been scanned.
+ */
+
+struct iwl_notif_statistics {
+        __le32 flag;
+        struct mvm_statistics_rx rx;
+        struct mvm_statistics_tx tx;
+        struct mvm_statistics_general general;
+} __packed; /* STATISTICS_NTFY_API_S_VER_8 */
+
+#endif /* __fw_api_stats_h__ */
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
index 5bca1f8bfebf..81c4ea3c6958 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
@@ -592,4 +592,43 @@ static inline u32 iwl_mvm_get_scd_ssn(struct iwl_mvm_tx_resp *tx_resp)
                             tx_resp->frame_count) & 0xfff;
 }
 
+/**
+ * struct iwl_scd_txq_cfg_cmd - New txq hw scheduler config command
+ * @token:
+ * @sta_id: station id
+ * @tid:
+ * @scd_queue: scheduler queue to confiug
+ * @enable: 1 queue enable, 0 queue disable
+ * @aggregate: 1 aggregated queue, 0 otherwise
+ * @tx_fifo: %enum iwl_mvm_tx_fifo
+ * @window: BA window size
+ * @ssn: SSN for the BA agreement
+ */
+struct iwl_scd_txq_cfg_cmd {
+        u8 token;
+        u8 sta_id;
+        u8 tid;
+        u8 scd_queue;
+        u8 enable;
+        u8 aggregate;
+        u8 tx_fifo;
+        u8 window;
+        __le16 ssn;
+        __le16 reserved;
+} __packed; /* SCD_QUEUE_CFG_CMD_API_S_VER_1 */
+
+/**
+ * struct iwl_scd_txq_cfg_rsp
+ * @token: taken from the command
+ * @sta_id: station id from the command
+ * @tid: tid from the command
+ * @scd_queue: scd_queue from the command
+ */
+struct iwl_scd_txq_cfg_rsp {
+        u8 token;
+        u8 sta_id;
+        u8 tid;
+        u8 scd_queue;
+} __packed; /* SCD_QUEUE_CFG_RSP_API_S_VER_1 */
+
 #endif /* __fw_api_tx_h__ */
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api.h b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
index 88af6dd2ceaa..b56154fe8ec5 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
@@ -74,6 +74,7 @@
 #include "fw-api-d3.h"
 #include "fw-api-coex.h"
 #include "fw-api-scan.h"
+#include "fw-api-stats.h"
 
 /* Tx queue numbers */
 enum {
@@ -128,6 +129,9 @@ enum {
         /* global key */
         WEP_KEY = 0x20,
 
+        /* Memory */
+        SHARED_MEM_CFG = 0x25,
+
         /* TDLS */
         TDLS_CHANNEL_SWITCH_CMD = 0x27,
         TDLS_CHANNEL_SWITCH_NOTIFICATION = 0xaa,
@@ -1381,214 +1385,6 @@ struct iwl_mvm_marker {
         __le32 metadata[0];
 } __packed; /* MARKER_API_S_VER_1 */
 
-struct mvm_statistics_dbg {
-        __le32 burst_check;
-        __le32 burst_count;
-        __le32 wait_for_silence_timeout_cnt;
-        __le32 reserved[3];
-} __packed; /* STATISTICS_DEBUG_API_S_VER_2 */
-
-struct mvm_statistics_div {
-        __le32 tx_on_a;
-        __le32 tx_on_b;
-        __le32 exec_time;
-        __le32 probe_time;
-        __le32 rssi_ant;
-        __le32 reserved2;
-} __packed; /* STATISTICS_SLOW_DIV_API_S_VER_2 */
-
-struct mvm_statistics_general_common {
-        __le32 temperature;   /* radio temperature */
-        __le32 temperature_m; /* radio voltage */
-        struct mvm_statistics_dbg dbg;
-        __le32 sleep_time;
-        __le32 slots_out;
-        __le32 slots_idle;
-        __le32 ttl_timestamp;
-        struct mvm_statistics_div div;
-        __le32 rx_enable_counter;
-        /*
-         * num_of_sos_states:
-         *  count the number of times we have to re-tune
-         *  in order to get out of bad PHY status
-         */
-        __le32 num_of_sos_states;
-} __packed; /* STATISTICS_GENERAL_API_S_VER_5 */
-
-struct mvm_statistics_rx_non_phy {
-        __le32 bogus_cts;       /* CTS received when not expecting CTS */
-        __le32 bogus_ack;       /* ACK received when not expecting ACK */
-        __le32 non_bssid_frames;        /* number of frames with BSSID that
-                                         * doesn't belong to the STA BSSID */
-        __le32 filtered_frames; /* count frames that were dumped in the
-                                 * filtering process */
-        __le32 non_channel_beacons;     /* beacons with our bss id but not on
-                                         * our serving channel */
-        __le32 channel_beacons; /* beacons with our bss id and in our
-                                 * serving channel */
-        __le32 num_missed_bcon; /* number of missed beacons */
-        __le32 adc_rx_saturation_time;  /* count in 0.8us units the time the
-                                         * ADC was in saturation */
-        __le32 ina_detection_search_time;/* total time (in 0.8us) searched
-                                          * for INA */
-        __le32 beacon_silence_rssi_a;   /* RSSI silence after beacon frame */
-        __le32 beacon_silence_rssi_b;   /* RSSI silence after beacon frame */
-        __le32 beacon_silence_rssi_c;   /* RSSI silence after beacon frame */
-        __le32 interference_data_flag;  /* flag for interference data
-                                         * availability. 1 when data is
-                                         * available. */
-        __le32 channel_load;            /* counts RX Enable time in uSec */
-        __le32 dsp_false_alarms;        /* DSP false alarm (both OFDM
-                                         * and CCK) counter */
-        __le32 beacon_rssi_a;
-        __le32 beacon_rssi_b;
-        __le32 beacon_rssi_c;
-        __le32 beacon_energy_a;
-        __le32 beacon_energy_b;
-        __le32 beacon_energy_c;
-        __le32 num_bt_kills;
-        __le32 mac_id;
-        __le32 directed_data_mpdu;
-} __packed; /* STATISTICS_RX_NON_PHY_API_S_VER_3 */
-
-struct mvm_statistics_rx_phy {
-        __le32 ina_cnt;
-        __le32 fina_cnt;
-        __le32 plcp_err;
-        __le32 crc32_err;
-        __le32 overrun_err;
-        __le32 early_overrun_err;
-        __le32 crc32_good;
-        __le32 false_alarm_cnt;
-        __le32 fina_sync_err_cnt;
-        __le32 sfd_timeout;
-        __le32 fina_timeout;
-        __le32 unresponded_rts;
-        __le32 rxe_frame_limit_overrun;
-        __le32 sent_ack_cnt;
-        __le32 sent_cts_cnt;
-        __le32 sent_ba_rsp_cnt;
-        __le32 dsp_self_kill;
-        __le32 mh_format_err;
-        __le32 re_acq_main_rssi_sum;
-        __le32 reserved;
-} __packed; /* STATISTICS_RX_PHY_API_S_VER_2 */
-
-struct mvm_statistics_rx_ht_phy {
-        __le32 plcp_err;
-        __le32 overrun_err;
-        __le32 early_overrun_err;
-        __le32 crc32_good;
-        __le32 crc32_err;
-        __le32 mh_format_err;
-        __le32 agg_crc32_good;
-        __le32 agg_mpdu_cnt;
-        __le32 agg_cnt;
-        __le32 unsupport_mcs;
-} __packed;  /* STATISTICS_HT_RX_PHY_API_S_VER_1 */
-
-#define MAX_CHAINS 3
-
-struct mvm_statistics_tx_non_phy_agg {
-        __le32 ba_timeout;
-        __le32 ba_reschedule_frames;
-        __le32 scd_query_agg_frame_cnt;
-        __le32 scd_query_no_agg;
-        __le32 scd_query_agg;
-        __le32 scd_query_mismatch;
-        __le32 frame_not_ready;
-        __le32 underrun;
-        __le32 bt_prio_kill;
-        __le32 rx_ba_rsp_cnt;
-        __s8 txpower[MAX_CHAINS];
-        __s8 reserved;
-        __le32 reserved2;
-} __packed; /* STATISTICS_TX_NON_PHY_AGG_API_S_VER_1 */
-
-struct mvm_statistics_tx_channel_width {
-        __le32 ext_cca_narrow_ch20[1];
-        __le32 ext_cca_narrow_ch40[2];
-        __le32 ext_cca_narrow_ch80[3];
-        __le32 ext_cca_narrow_ch160[4];
-        __le32 last_tx_ch_width_indx;
-        __le32 rx_detected_per_ch_width[4];
-        __le32 success_per_ch_width[4];
-        __le32 fail_per_ch_width[4];
-}; /* STATISTICS_TX_CHANNEL_WIDTH_API_S_VER_1 */
-
-struct mvm_statistics_tx {
-        __le32 preamble_cnt;
-        __le32 rx_detected_cnt;
-        __le32 bt_prio_defer_cnt;
-        __le32 bt_prio_kill_cnt;
-        __le32 few_bytes_cnt;
-        __le32 cts_timeout;
-        __le32 ack_timeout;
-        __le32 expected_ack_cnt;
-        __le32 actual_ack_cnt;
-        __le32 dump_msdu_cnt;
-        __le32 burst_abort_next_frame_mismatch_cnt;
-        __le32 burst_abort_missing_next_frame_cnt;
-        __le32 cts_timeout_collision;
-        __le32 ack_or_ba_timeout_collision;
-        struct mvm_statistics_tx_non_phy_agg agg;
-        struct mvm_statistics_tx_channel_width channel_width;
-} __packed; /* STATISTICS_TX_API_S_VER_4 */
-
-
-struct mvm_statistics_bt_activity {
-        __le32 hi_priority_tx_req_cnt;
-        __le32 hi_priority_tx_denied_cnt;
-        __le32 lo_priority_tx_req_cnt;
-        __le32 lo_priority_tx_denied_cnt;
-        __le32 hi_priority_rx_req_cnt;
-        __le32 hi_priority_rx_denied_cnt;
-        __le32 lo_priority_rx_req_cnt;
-        __le32 lo_priority_rx_denied_cnt;
-} __packed;  /* STATISTICS_BT_ACTIVITY_API_S_VER_1 */
-
-struct mvm_statistics_general {
-        struct mvm_statistics_general_common common;
-        __le32 beacon_filtered;
-        __le32 missed_beacons;
-        __s8 beacon_filter_average_energy;
-        __s8 beacon_filter_reason;
-        __s8 beacon_filter_current_energy;
-        __s8 beacon_filter_reserved;
-        __le32 beacon_filter_delta_time;
-        struct mvm_statistics_bt_activity bt_activity;
-} __packed; /* STATISTICS_GENERAL_API_S_VER_5 */
-
-struct mvm_statistics_rx {
-        struct mvm_statistics_rx_phy ofdm;
-        struct mvm_statistics_rx_phy cck;
-        struct mvm_statistics_rx_non_phy general;
-        struct mvm_statistics_rx_ht_phy ofdm_ht;
-} __packed; /* STATISTICS_RX_API_S_VER_3 */
-
-/*
- * STATISTICS_NOTIFICATION = 0x9d (notification only, not a command)
- *
- * By default, uCode issues this notification after receiving a beacon
- * while associated.  To disable this behavior, set DISABLE_NOTIF flag in the
- * REPLY_STATISTICS_CMD 0x9c, above.
- *
- * Statistics counters continue to increment beacon after beacon, but are
- * cleared when changing channels or when driver issues REPLY_STATISTICS_CMD
- * 0x9c with CLEAR_STATS bit set (see above).
- *
- * uCode also issues this notification during scans.  uCode clears statistics
- * appropriately so that each notification contains statistics for only the
- * one channel that has just been scanned.
- */
-
-struct iwl_notif_statistics { /* STATISTICS_NTFY_API_S_VER_8 */
-        __le32 flag;
-        struct mvm_statistics_rx rx;
-        struct mvm_statistics_tx tx;
-        struct mvm_statistics_general general;
-} __packed;
-
 /***********************************
  * Smart Fifo API
  ***********************************/
@@ -1680,63 +1476,6 @@ struct iwl_dts_measurement_notif {
         __le32 voltage;
 } __packed; /* TEMPERATURE_MEASUREMENT_TRIGGER_NTFY_S */
 
-/**
- * enum iwl_scd_control - scheduler config command control flags
- * @IWL_SCD_CONTROL_RM_TID: remove TID from this queue
- * @IWL_SCD_CONTROL_SET_SSN: use the SSN and program it into HW
- */
-enum iwl_scd_control {
-        IWL_SCD_CONTROL_RM_TID  = BIT(4),
-        IWL_SCD_CONTROL_SET_SSN = BIT(5),
-};
-
-/**
- * enum iwl_scd_flags - scheduler config command flags
- * @IWL_SCD_FLAGS_SHARE_TID: multiple TIDs map to this queue
- * @IWL_SCD_FLAGS_SHARE_RA: multiple RAs map to this queue
- * @IWL_SCD_FLAGS_DQA_ENABLED: DQA is enabled
- */
-enum iwl_scd_flags {
-        IWL_SCD_FLAGS_SHARE_TID         = BIT(0),
-        IWL_SCD_FLAGS_SHARE_RA          = BIT(1),
-        IWL_SCD_FLAGS_DQA_ENABLED       = BIT(2),
-};
-
-#define IWL_SCDQ_INVALID_STA    0xff
-
-/**
- * struct iwl_scd_txq_cfg_cmd - New txq hw scheduler config command
- * @token:      dialog token addba - unused legacy
- * @sta_id:     station id 4-bit
- * @tid:        TID 0..7
- * @scd_queue:  TFD queue num 0 .. 31
- * @enable:     1 queue enable, 0 queue disable
- * @aggregate:  1 aggregated queue, 0 otherwise
- * @tx_fifo:    tx fifo num 0..7
- * @window:     up to 64
- * @ssn:        starting seq num 12-bit
- * @control:    command control flags
- * @flags:      flags - see &enum iwl_scd_flags
- *
- * Note that every time the command is sent, all parameters must
- * be filled with the exception of
- *  - the SSN, which is only used with @IWL_SCD_CONTROL_SET_SSN
- *  - the window, which is only relevant when starting aggregation
- */
-struct iwl_scd_txq_cfg_cmd {
-        u8 token;
-        u8 sta_id;
-        u8 tid;
-        u8 scd_queue;
-        u8 enable;
-        u8 aggregate;
-        u8 tx_fifo;
-        u8 window;
-        __le16 ssn;
-        u8 control;
-        u8 flags;
-} __packed;
-
 /***********************************
  * TDLS API
  ***********************************/
@@ -1878,4 +1617,36 @@ struct iwl_tdls_config_res {
         struct iwl_tdls_config_sta_info_res sta_info[IWL_MVM_TDLS_STA_COUNT];
 } __packed; /* TDLS_CONFIG_RSP_API_S_VER_1 */
 
+#define TX_FIFO_MAX_NUM         8
+#define RX_FIFO_MAX_NUM         2
+
+/**
+ * Shared memory configuration information from the FW
+ *
+ * @shared_mem_addr: shared memory addr (pre 8000 HW set to 0x0 as MARBH is not
+ *      accessible)
+ * @shared_mem_size: shared memory size
+ * @sample_buff_addr: internal sample (mon/adc) buff addr (pre 8000 HW set to
+ *      0x0 as accessible only via DBGM RDAT)
+ * @sample_buff_size: internal sample buff size
+ * @txfifo_addr: start addr of TXF0 (excluding the context table 0.5KB), (pre
+ *      8000 HW set to 0x0 as not accessible)
+ * @txfifo_size: size of TXF0 ... TXF7
+ * @rxfifo_size: RXF1, RXF2 sizes. If there is no RXF2, it'll have a value of 0
+ * @page_buff_addr: used by UMAC and performance debug (page miss analysis),
+ *      when paging is not supported this should be 0
+ * @page_buff_size: size of %page_buff_addr
+ */
+struct iwl_shared_mem_cfg {
+        __le32 shared_mem_addr;
+        __le32 shared_mem_size;
+        __le32 sample_buff_addr;
+        __le32 sample_buff_size;
+        __le32 txfifo_addr;
+        __le32 txfifo_size[TX_FIFO_MAX_NUM];
+        __le32 rxfifo_size[RX_FIFO_MAX_NUM];
+        __le32 page_buff_addr;
+        __le32 page_buff_size;
+} __packed; /* SHARED_MEM_ALLOC_API_S_VER_1 */
+
 #endif /* __fw_api_h__ */
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw.c b/drivers/net/wireless/iwlwifi/mvm/fw.c
index d0fa6e9ed590..ca38e9817374 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/iwlwifi/mvm/fw.c
@@ -70,6 +70,7 @@
 #include "iwl-debug.h"
 #include "iwl-csr.h" /* for iwl_mvm_rx_card_state_notif */
 #include "iwl-io.h" /* for iwl_mvm_rx_card_state_notif */
+#include "iwl-prph.h"
 #include "iwl-eeprom-parse.h"
 
 #include "mvm.h"
@@ -269,7 +270,7 @@ static int iwl_send_phy_cfg_cmd(struct iwl_mvm *mvm)
         enum iwl_ucode_type ucode_type = mvm->cur_ucode;
 
         /* Set parameters */
-        phy_cfg_cmd.phy_cfg = cpu_to_le32(mvm->fw->phy_config);
+        phy_cfg_cmd.phy_cfg = cpu_to_le32(iwl_mvm_get_phy_config(mvm));
         phy_cfg_cmd.calib_control.event_trigger =
                 mvm->fw->default_calib[ucode_type].event_trigger;
         phy_cfg_cmd.calib_control.flow_trigger =
@@ -346,7 +347,7 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
         mvm->calibrating = true;
 
         /* Send TX valid antennas before triggering calibrations */
-        ret = iwl_send_tx_ant_cfg(mvm, mvm->fw->valid_tx_ant);
+        ret = iwl_send_tx_ant_cfg(mvm, iwl_mvm_get_valid_tx_ant(mvm));
         if (ret)
                 goto error;
 
@@ -399,8 +400,71 @@ out:
         return ret;
 }
 
-static int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm,
-                                     enum iwl_fw_dbg_conf conf_id)
+static void iwl_mvm_get_shared_mem_conf(struct iwl_mvm *mvm)
+{
+        struct iwl_host_cmd cmd = {
+                .id = SHARED_MEM_CFG,
+                .flags = CMD_WANT_SKB,
+                .data = { NULL, },
+                .len = { 0, },
+        };
+        struct iwl_rx_packet *pkt;
+        struct iwl_shared_mem_cfg *mem_cfg;
+        u32 i;
+
+        lockdep_assert_held(&mvm->mutex);
+
+        if (WARN_ON(iwl_mvm_send_cmd(mvm, &cmd)))
+                return;
+
+        pkt = cmd.resp_pkt;
+        if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
+                IWL_ERR(mvm, "Bad return from SHARED_MEM_CFG (0x%08X)\n",
+                        pkt->hdr.flags);
+                goto exit;
+        }
+
+        mem_cfg = (void *)pkt->data;
+
+        mvm->shared_mem_cfg.shared_mem_addr =
+                le32_to_cpu(mem_cfg->shared_mem_addr);
+        mvm->shared_mem_cfg.shared_mem_size =
+                le32_to_cpu(mem_cfg->shared_mem_size);
+        mvm->shared_mem_cfg.sample_buff_addr =
+                le32_to_cpu(mem_cfg->sample_buff_addr);
+        mvm->shared_mem_cfg.sample_buff_size =
+                le32_to_cpu(mem_cfg->sample_buff_size);
+        mvm->shared_mem_cfg.txfifo_addr = le32_to_cpu(mem_cfg->txfifo_addr);
+        for (i = 0; i < ARRAY_SIZE(mvm->shared_mem_cfg.txfifo_size); i++)
+                mvm->shared_mem_cfg.txfifo_size[i] =
+                        le32_to_cpu(mem_cfg->txfifo_size[i]);
+        for (i = 0; i < ARRAY_SIZE(mvm->shared_mem_cfg.rxfifo_size); i++)
+                mvm->shared_mem_cfg.rxfifo_size[i] =
+                        le32_to_cpu(mem_cfg->rxfifo_size[i]);
+        mvm->shared_mem_cfg.page_buff_addr =
+                le32_to_cpu(mem_cfg->page_buff_addr);
+        mvm->shared_mem_cfg.page_buff_size =
+                le32_to_cpu(mem_cfg->page_buff_size);
+        IWL_DEBUG_INFO(mvm, "SHARED MEM CFG: got memory offsets/sizes\n");
+
+exit:
+        iwl_free_resp(&cmd);
+}
+
+void iwl_mvm_fw_dbg_collect(struct iwl_mvm *mvm)
+{
+        /* stop recording */
+        if (mvm->cfg->device_family == IWL_DEVICE_FAMILY_7000) {
+                iwl_set_bits_prph(mvm->trans, MON_BUFF_SAMPLE_CTL, 0x100);
+        } else {
+                iwl_write_prph(mvm->trans, DBGC_IN_SAMPLE, 0);
+                iwl_write_prph(mvm->trans, DBGC_OUT_CTRL, 0);
+        }
+
+        schedule_work(&mvm->fw_error_dump_wk);
+}
+
+int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm, enum iwl_fw_dbg_conf conf_id)
 {
         u8 *ptr;
         int ret;
@@ -435,6 +499,35 @@ static int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm,
         return ret;
 }
 
+static int iwl_mvm_config_ltr_v1(struct iwl_mvm *mvm)
+{
+        struct iwl_ltr_config_cmd_v1 cmd_v1 = {
+                .flags = cpu_to_le32(LTR_CFG_FLAG_FEATURE_ENABLE),
+        };
+
+        if (!mvm->trans->ltr_enabled)
+                return 0;
+
+        return iwl_mvm_send_cmd_pdu(mvm, LTR_CONFIG, 0,
+                                    sizeof(cmd_v1), &cmd_v1);
+}
+
+static int iwl_mvm_config_ltr(struct iwl_mvm *mvm)
+{
+        struct iwl_ltr_config_cmd cmd = {
+                .flags = cpu_to_le32(LTR_CFG_FLAG_FEATURE_ENABLE),
+        };
+
+        if (!mvm->trans->ltr_enabled)
+                return 0;
+
+        if (!(mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_HDC_PHASE_0))
+                return iwl_mvm_config_ltr_v1(mvm);
+
+        return iwl_mvm_send_cmd_pdu(mvm, LTR_CONFIG, 0,
+                                    sizeof(cmd), &cmd);
+}
+
 int iwl_mvm_up(struct iwl_mvm *mvm)
 {
         int ret, i;
@@ -482,6 +575,9 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
                 goto error;
         }
 
+        if (IWL_UCODE_API(mvm->fw->ucode_ver) >= 10)
+                iwl_mvm_get_shared_mem_conf(mvm);
+
         ret = iwl_mvm_sf_update(mvm, NULL, false);
         if (ret)
                 IWL_ERR(mvm, "Failed to initialize Smart Fifo\n");
@@ -489,7 +585,7 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
         mvm->fw_dbg_conf = FW_DBG_INVALID;
         iwl_mvm_start_fw_dbg_conf(mvm, FW_DBG_CUSTOM);
 
-        ret = iwl_send_tx_ant_cfg(mvm, mvm->fw->valid_tx_ant);
+        ret = iwl_send_tx_ant_cfg(mvm, iwl_mvm_get_valid_tx_ant(mvm));
         if (ret)
                 goto error;
 
@@ -538,14 +634,7 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
         /* Initialize tx backoffs to the minimal possible */
         iwl_mvm_tt_tx_backoff(mvm, 0);
 
-        if (mvm->trans->ltr_enabled) {
-                struct iwl_ltr_config_cmd cmd = {
-                        .flags = cpu_to_le32(LTR_CFG_FLAG_FEATURE_ENABLE),
-                };
-
-                WARN_ON(iwl_mvm_send_cmd_pdu(mvm, LTR_CONFIG, 0,
-                                             sizeof(cmd), &cmd));
-        }
+        WARN_ON(iwl_mvm_config_ltr(mvm));
 
         ret = iwl_mvm_power_update_device(mvm);
         if (ret)
@@ -584,7 +673,7 @@ int iwl_mvm_load_d3_fw(struct iwl_mvm *mvm)
                 goto error;
         }
 
-        ret = iwl_send_tx_ant_cfg(mvm, mvm->fw->valid_tx_ant);
+        ret = iwl_send_tx_ant_cfg(mvm, iwl_mvm_get_valid_tx_ant(mvm));
         if (ret)
                 goto error;
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
index f6d86ccce6a8..7bdc6220743f 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
@@ -208,8 +208,10 @@ u32 iwl_mvm_mac_get_queues_mask(struct ieee80211_vif *vif)
         if (vif->type == NL80211_IFTYPE_P2P_DEVICE)
                 return BIT(IWL_MVM_OFFCHANNEL_QUEUE);
 
-        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
-                qmask |= BIT(vif->hw_queue[ac]);
+        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+                if (vif->hw_queue[ac] != IEEE80211_INVAL_HW_QUEUE)
+                        qmask |= BIT(vif->hw_queue[ac]);
+        }
 
         if (vif->type == NL80211_IFTYPE_AP)
                 qmask |= BIT(vif->cab_queue);
@@ -460,6 +462,9 @@ exit_fail:
 
 int iwl_mvm_mac_ctxt_init(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 {
+        unsigned int wdg_timeout = iwlmvm_mod_params.tfd_q_hang_detect ?
+                                        mvm->cfg->base_params->wd_timeout :
+                                        IWL_WATCHDOG_DISABLED;
         u32 ac;
         int ret;
 
@@ -472,16 +477,17 @@ int iwl_mvm_mac_ctxt_init(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
         switch (vif->type) {
         case NL80211_IFTYPE_P2P_DEVICE:
                 iwl_mvm_enable_ac_txq(mvm, IWL_MVM_OFFCHANNEL_QUEUE,
-                                      IWL_MVM_TX_FIFO_VO);
+                                      IWL_MVM_TX_FIFO_VO, wdg_timeout);
                 break;
         case NL80211_IFTYPE_AP:
                 iwl_mvm_enable_ac_txq(mvm, vif->cab_queue,
-                                      IWL_MVM_TX_FIFO_MCAST);
+                                      IWL_MVM_TX_FIFO_MCAST, wdg_timeout);
                 /* fall through */
         default:
                 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
                         iwl_mvm_enable_ac_txq(mvm, vif->hw_queue[ac],
-                                              iwl_mvm_ac_to_tx_fifo[ac]);
+                                              iwl_mvm_ac_to_tx_fifo[ac],
+                                              wdg_timeout);
                 break;
         }
 
@@ -496,14 +502,14 @@ void iwl_mvm_mac_ctxt_release(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 
         switch (vif->type) {
         case NL80211_IFTYPE_P2P_DEVICE:
-                iwl_mvm_disable_txq(mvm, IWL_MVM_OFFCHANNEL_QUEUE);
+                iwl_mvm_disable_txq(mvm, IWL_MVM_OFFCHANNEL_QUEUE, 0);
                 break;
         case NL80211_IFTYPE_AP:
-                iwl_mvm_disable_txq(mvm, vif->cab_queue);
+                iwl_mvm_disable_txq(mvm, vif->cab_queue, 0);
                 /* fall through */
         default:
                 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
-                        iwl_mvm_disable_txq(mvm, vif->hw_queue[ac]);
+                        iwl_mvm_disable_txq(mvm, vif->hw_queue[ac], 0);
         }
 }
 
@@ -975,7 +981,7 @@ static int iwl_mvm_mac_ctxt_send_beacon(struct iwl_mvm *mvm,
         beacon_cmd.tx.tx_flags = cpu_to_le32(tx_flags);
 
         mvm->mgmt_last_antenna_idx =
-                iwl_mvm_next_antenna(mvm, mvm->fw->valid_tx_ant,
+                iwl_mvm_next_antenna(mvm, iwl_mvm_get_valid_tx_ant(mvm),
                                      mvm->mgmt_last_antenna_idx);
 
         beacon_cmd.tx.rate_n_flags =
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 20915587c820..1ff7ec08532d 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -85,6 +85,7 @@
 #include "testmode.h"
 #include "iwl-fw-error-dump.h"
 #include "iwl-prph.h"
+#include "iwl-csr.h"
 
 static const struct ieee80211_iface_limit iwl_mvm_limits[] = {
         {
@@ -105,7 +106,7 @@ static const struct ieee80211_iface_limit iwl_mvm_limits[] = {
 
 static const struct ieee80211_iface_combination iwl_mvm_iface_combinations[] = {
         {
-                .num_different_channels = 1,
+                .num_different_channels = 2,
                 .max_interfaces = 3,
                 .limits = iwl_mvm_limits,
                 .n_limits = ARRAY_SIZE(iwl_mvm_limits),
@@ -326,6 +327,8 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
         hw->radiotap_vht_details |= IEEE80211_RADIOTAP_VHT_KNOWN_STBC |
                 IEEE80211_RADIOTAP_VHT_KNOWN_BEAMFORMED;
         hw->rate_control_algorithm = "iwl-mvm-rs";
+        hw->uapsd_queues = IWL_MVM_UAPSD_QUEUES;
+        hw->uapsd_max_sp_len = IWL_UAPSD_MAX_SP;
 
         /*
          * Enable 11w if advertised by firmware and software crypto
@@ -336,13 +339,6 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
             !iwlwifi_mod_params.sw_crypto)
                 hw->flags |= IEEE80211_HW_MFP_CAPABLE;
 
-        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT &&
-            !iwlwifi_mod_params.uapsd_disable) {
-                hw->flags |= IEEE80211_HW_SUPPORTS_UAPSD;
-                hw->uapsd_queues = IWL_MVM_UAPSD_QUEUES;
-                hw->uapsd_max_sp_len = IWL_UAPSD_MAX_SP;
-        }
-
         if (mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_LMAC_SCAN ||
             mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_UMAC_SCAN) {
                 hw->flags |= IEEE80211_SINGLE_HW_SCAN_ON_ALL_BANDS;
@@ -377,6 +373,8 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
 
         hw->wiphy->max_remain_on_channel_duration = 10000;
         hw->max_listen_interval = IWL_CONN_MAX_LISTEN_INTERVAL;
+        /* we can compensate an offset of up to 3 channels = 15 MHz */
+        hw->wiphy->max_adj_channel_rssi_comp = 3 * 5;
 
         /* Extract MAC address */
         memcpy(mvm->addresses[0].addr, mvm->nvm_data->hw_addr, ETH_ALEN);
@@ -403,10 +401,15 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
         if (mvm->nvm_data->bands[IEEE80211_BAND_2GHZ].n_channels)
                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
                         &mvm->nvm_data->bands[IEEE80211_BAND_2GHZ];
-        if (mvm->nvm_data->bands[IEEE80211_BAND_5GHZ].n_channels)
+        if (mvm->nvm_data->bands[IEEE80211_BAND_5GHZ].n_channels) {
                 hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
                         &mvm->nvm_data->bands[IEEE80211_BAND_5GHZ];
 
+                if (mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_BEAMFORMER)
+                        hw->wiphy->bands[IEEE80211_BAND_5GHZ]->vht_cap.cap |=
+                                IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
+        }
+
         hw->wiphy->hw_version = mvm->trans->hw_id;
 
         if (iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM)
@@ -459,15 +462,17 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
             device_can_wakeup(mvm->trans->dev)) {
                 mvm->wowlan.flags = WIPHY_WOWLAN_ANY;
                 hw->wiphy->wowlan = &mvm->wowlan;
-        } else if (mvm->fw->img[IWL_UCODE_WOWLAN].sec[0].len &&
+        }
+
+        if (mvm->fw->img[IWL_UCODE_WOWLAN].sec[0].len &&
             mvm->trans->ops->d3_suspend &&
             mvm->trans->ops->d3_resume &&
             device_can_wakeup(mvm->trans->dev)) {
-                mvm->wowlan.flags = WIPHY_WOWLAN_MAGIC_PKT |
-                                    WIPHY_WOWLAN_DISCONNECT |
-                                    WIPHY_WOWLAN_EAP_IDENTITY_REQ |
-                                    WIPHY_WOWLAN_RFKILL_RELEASE |
-                                    WIPHY_WOWLAN_NET_DETECT;
+                mvm->wowlan.flags |= WIPHY_WOWLAN_MAGIC_PKT |
+                                     WIPHY_WOWLAN_DISCONNECT |
+                                     WIPHY_WOWLAN_EAP_IDENTITY_REQ |
+                                     WIPHY_WOWLAN_RFKILL_RELEASE |
+                                     WIPHY_WOWLAN_NET_DETECT;
                 if (!iwlwifi_mod_params.sw_crypto)
                         mvm->wowlan.flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY |
                                              WIPHY_WOWLAN_GTK_REKEY_FAILURE |
@@ -707,9 +712,6 @@ static void iwl_mvm_cleanup_iterator(void *data, u8 *mac,
         mvmvif->uploaded = false;
         mvmvif->ap_sta_id = IWL_MVM_STATION_COUNT;
 
-        /* does this make sense at all? */
-        mvmvif->color++;
-
         spin_lock_bh(&mvm->time_event_lock);
         iwl_mvm_te_clear_data(mvm, &mvmvif->time_event_data);
         spin_unlock_bh(&mvm->time_event_lock);
@@ -761,41 +763,215 @@ static void iwl_mvm_free_coredump(const void *data)
         kfree(fw_error_dump);
 }
 
+static void iwl_mvm_dump_fifos(struct iwl_mvm *mvm,
+                               struct iwl_fw_error_dump_data **dump_data)
+{
+        struct iwl_fw_error_dump_fifo *fifo_hdr;
+        u32 *fifo_data;
+        u32 fifo_len;
+        unsigned long flags;
+        int i, j;
+
+        if (!iwl_trans_grab_nic_access(mvm->trans, false, &flags))
+                return;
+
+        /* Pull RXF data from all RXFs */
+        for (i = 0; i < ARRAY_SIZE(mvm->shared_mem_cfg.rxfifo_size); i++) {
+                /*
+                 * Keep aside the additional offset that might be needed for
+                 * next RXF
+                 */
+                u32 offset_diff = RXF_DIFF_FROM_PREV * i;
+
+                fifo_hdr = (void *)(*dump_data)->data;
+                fifo_data = (void *)fifo_hdr->data;
+                fifo_len = mvm->shared_mem_cfg.rxfifo_size[i];
+
+                /* No need to try to read the data if the length is 0 */
+                if (fifo_len == 0)
+                        continue;
+
+                /* Add a TLV for the RXF */
+                (*dump_data)->type = cpu_to_le32(IWL_FW_ERROR_DUMP_RXF);
+                (*dump_data)->len = cpu_to_le32(fifo_len + sizeof(*fifo_hdr));
+
+                fifo_hdr->fifo_num = cpu_to_le32(i);
+                fifo_hdr->available_bytes =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        RXF_RD_D_SPACE +
+                                                        offset_diff));
+                fifo_hdr->wr_ptr =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        RXF_RD_WR_PTR +
+                                                        offset_diff));
+                fifo_hdr->rd_ptr =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        RXF_RD_RD_PTR +
+                                                        offset_diff));
+                fifo_hdr->fence_ptr =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        RXF_RD_FENCE_PTR +
+                                                        offset_diff));
+                fifo_hdr->fence_mode =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        RXF_SET_FENCE_MODE +
+                                                        offset_diff));
+
+                /* Lock fence */
+                iwl_trans_write_prph(mvm->trans,
+                                     RXF_SET_FENCE_MODE + offset_diff, 0x1);
+                /* Set fence pointer to the same place like WR pointer */
+                iwl_trans_write_prph(mvm->trans,
+                                     RXF_LD_WR2FENCE + offset_diff, 0x1);
+                /* Set fence offset */
+                iwl_trans_write_prph(mvm->trans,
+                                     RXF_LD_FENCE_OFFSET_ADDR + offset_diff,
+                                     0x0);
+
+                /* Read FIFO */
+                fifo_len /= sizeof(u32); /* Size in DWORDS */
+                for (j = 0; j < fifo_len; j++)
+                        fifo_data[j] = iwl_trans_read_prph(mvm->trans,
+                                                         RXF_FIFO_RD_FENCE_INC +
+                                                         offset_diff);
+                *dump_data = iwl_fw_error_next_data(*dump_data);
+        }
+
+        /* Pull TXF data from all TXFs */
+        for (i = 0; i < ARRAY_SIZE(mvm->shared_mem_cfg.txfifo_size); i++) {
+                /* Mark the number of TXF we're pulling now */
+                iwl_trans_write_prph(mvm->trans, TXF_LARC_NUM, i);
+
+                fifo_hdr = (void *)(*dump_data)->data;
+                fifo_data = (void *)fifo_hdr->data;
+                fifo_len = mvm->shared_mem_cfg.txfifo_size[i];
+
+                /* No need to try to read the data if the length is 0 */
+                if (fifo_len == 0)
+                        continue;
+
+                /* Add a TLV for the FIFO */
+                (*dump_data)->type = cpu_to_le32(IWL_FW_ERROR_DUMP_TXF);
+                (*dump_data)->len = cpu_to_le32(fifo_len + sizeof(*fifo_hdr));
+
+                fifo_hdr->fifo_num = cpu_to_le32(i);
+                fifo_hdr->available_bytes =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        TXF_FIFO_ITEM_CNT));
+                fifo_hdr->wr_ptr =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        TXF_WR_PTR));
+                fifo_hdr->rd_ptr =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        TXF_RD_PTR));
+                fifo_hdr->fence_ptr =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        TXF_FENCE_PTR));
+                fifo_hdr->fence_mode =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        TXF_LOCK_FENCE));
+
+                /* Set the TXF_READ_MODIFY_ADDR to TXF_WR_PTR */
+                iwl_trans_write_prph(mvm->trans, TXF_READ_MODIFY_ADDR,
+                                     TXF_WR_PTR);
+
+                /* Dummy-read to advance the read pointer to the head */
+                iwl_trans_read_prph(mvm->trans, TXF_READ_MODIFY_DATA);
+
+                /* Read FIFO */
+                fifo_len /= sizeof(u32); /* Size in DWORDS */
+                for (j = 0; j < fifo_len; j++)
+                        fifo_data[j] = iwl_trans_read_prph(mvm->trans,
+                                                          TXF_READ_MODIFY_DATA);
+                *dump_data = iwl_fw_error_next_data(*dump_data);
+        }
+
+        iwl_trans_release_nic_access(mvm->trans, &flags);
+}
+
 void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm)
 {
         struct iwl_fw_error_dump_file *dump_file;
         struct iwl_fw_error_dump_data *dump_data;
         struct iwl_fw_error_dump_info *dump_info;
+        struct iwl_fw_error_dump_mem *dump_mem;
         struct iwl_mvm_dump_ptrs *fw_error_dump;
-        const struct fw_img *img;
         u32 sram_len, sram_ofs;
-        u32 file_len, rxf_len;
-        unsigned long flags;
-        int reg_val;
+        u32 file_len, fifo_data_len = 0;
+        u32 smem_len = mvm->cfg->smem_len;
+        u32 sram2_len = mvm->cfg->dccm2_len;
 
         lockdep_assert_held(&mvm->mutex);
 
+        /* W/A for 8000 HW family A-step */
+        if (mvm->cfg->device_family == IWL_DEVICE_FAMILY_8000 &&
+            CSR_HW_REV_STEP(mvm->trans->hw_rev) == SILICON_A_STEP) {
+                if (smem_len)
+                        smem_len = 0x38000;
+
+                if (sram2_len)
+                        sram2_len = 0x10000;
+        }
+
         fw_error_dump = kzalloc(sizeof(*fw_error_dump), GFP_KERNEL);
         if (!fw_error_dump)
                 return;
 
-        img = &mvm->fw->img[mvm->cur_ucode];
-        sram_ofs = img->sec[IWL_UCODE_SECTION_DATA].offset;
-        sram_len = img->sec[IWL_UCODE_SECTION_DATA].len;
+        /* SRAM - include stack CCM if driver knows the values for it */
+        if (!mvm->cfg->dccm_offset || !mvm->cfg->dccm_len) {
+                const struct fw_img *img;
+
+                img = &mvm->fw->img[mvm->cur_ucode];
+                sram_ofs = img->sec[IWL_UCODE_SECTION_DATA].offset;
+                sram_len = img->sec[IWL_UCODE_SECTION_DATA].len;
+        } else {
+                sram_ofs = mvm->cfg->dccm_offset;
+                sram_len = mvm->cfg->dccm_len;
+        }
+
+        /* reading RXF/TXF sizes */
+        if (test_bit(STATUS_FW_ERROR, &mvm->trans->status)) {
+                struct iwl_mvm_shared_mem_cfg *mem_cfg = &mvm->shared_mem_cfg;
+                int i;
+
+                fifo_data_len = 0;
+
+                /* Count RXF size */
+                for (i = 0; i < ARRAY_SIZE(mem_cfg->rxfifo_size); i++) {
+                        if (!mem_cfg->rxfifo_size[i])
+                                continue;
+
+                        /* Add header info */
+                        fifo_data_len += mem_cfg->rxfifo_size[i] +
+                                         sizeof(*dump_data) +
+                                         sizeof(struct iwl_fw_error_dump_fifo);
+                }
 
-        /* reading buffer size */
-        reg_val = iwl_trans_read_prph(mvm->trans, RXF_SIZE_ADDR);
-        rxf_len = (reg_val & RXF_SIZE_BYTE_CNT_MSK) >> RXF_SIZE_BYTE_CND_POS;
+                for (i = 0; i < ARRAY_SIZE(mem_cfg->txfifo_size); i++) {
+                        if (!mem_cfg->txfifo_size[i])
+                                continue;
 
-        /* the register holds the value divided by 128 */
-        rxf_len = rxf_len << 7;
+                        /* Add header info */
+                        fifo_data_len += mem_cfg->txfifo_size[i] +
+                                         sizeof(*dump_data) +
+                                         sizeof(struct iwl_fw_error_dump_fifo);
+                }
+        }
 
         file_len = sizeof(*dump_file) +
-                   sizeof(*dump_data) * 3 +
-                   sram_len +
-                   rxf_len +
+                   sizeof(*dump_data) * 2 +
+                   sram_len + sizeof(*dump_mem) +
+                   fifo_data_len +
                    sizeof(*dump_info);
 
+        /* Make room for the SMEM, if it exists */
+        if (smem_len)
+                file_len += sizeof(*dump_data) + sizeof(*dump_mem) + smem_len;
+
+        /* Make room for the secondary SRAM, if it exists */
+        if (sram2_len)
+                file_len += sizeof(*dump_data) + sizeof(*dump_mem) + sram2_len;
+
         dump_file = vzalloc(file_len);
         if (!dump_file) {
                 kfree(fw_error_dump);
@@ -814,6 +990,7 @@ void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm)
                 mvm->cfg->device_family == IWL_DEVICE_FAMILY_7000 ?
                         cpu_to_le32(IWL_FW_ERROR_DUMP_FAMILY_7) :
                         cpu_to_le32(IWL_FW_ERROR_DUMP_FAMILY_8);
+        dump_info->hw_step = cpu_to_le32(CSR_HW_REV_STEP(mvm->trans->hw_rev));
         memcpy(dump_info->fw_human_readable, mvm->fw->human_readable,
                sizeof(dump_info->fw_human_readable));
         strncpy(dump_info->dev_human_readable, mvm->cfg->name,
@@ -822,28 +999,39 @@ void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm)
                 sizeof(dump_info->bus_human_readable));
 
         dump_data = iwl_fw_error_next_data(dump_data);
-        dump_data->type = cpu_to_le32(IWL_FW_ERROR_DUMP_RXF);
-        dump_data->len = cpu_to_le32(rxf_len);
-
-        if (iwl_trans_grab_nic_access(mvm->trans, false, &flags)) {
-                u32 *rxf = (void *)dump_data->data;
-                int i;
+        /* We only dump the FIFOs if the FW is in error state */
+        if (test_bit(STATUS_FW_ERROR, &mvm->trans->status))
+                iwl_mvm_dump_fifos(mvm, &dump_data);
+
+        dump_data->type = cpu_to_le32(IWL_FW_ERROR_DUMP_MEM);
+        dump_data->len = cpu_to_le32(sram_len + sizeof(*dump_mem));
+        dump_mem = (void *)dump_data->data;
+        dump_mem->type = cpu_to_le32(IWL_FW_ERROR_DUMP_MEM_SRAM);
+        dump_mem->offset = cpu_to_le32(sram_ofs);
+        iwl_trans_read_mem_bytes(mvm->trans, sram_ofs, dump_mem->data,
+                                 sram_len);
 
-                for (i = 0; i < (rxf_len / sizeof(u32)); i++) {
-                        iwl_trans_write_prph(mvm->trans,
-                                             RXF_LD_FENCE_OFFSET_ADDR,
-                                             i * sizeof(u32));
-                        rxf[i] = iwl_trans_read_prph(mvm->trans,
-                                                     RXF_FIFO_RD_FENCE_ADDR);
-                }
-                iwl_trans_release_nic_access(mvm->trans, &flags);
+        if (smem_len) {
+                dump_data = iwl_fw_error_next_data(dump_data);
+                dump_data->type = cpu_to_le32(IWL_FW_ERROR_DUMP_MEM);
+                dump_data->len = cpu_to_le32(smem_len + sizeof(*dump_mem));
+                dump_mem = (void *)dump_data->data;
+                dump_mem->type = cpu_to_le32(IWL_FW_ERROR_DUMP_MEM_SMEM);
+                dump_mem->offset = cpu_to_le32(mvm->cfg->smem_offset);
+                iwl_trans_read_mem_bytes(mvm->trans, mvm->cfg->smem_offset,
+                                         dump_mem->data, smem_len);
         }
 
-        dump_data = iwl_fw_error_next_data(dump_data);
-        dump_data->type = cpu_to_le32(IWL_FW_ERROR_DUMP_SRAM);
-        dump_data->len = cpu_to_le32(sram_len);
-        iwl_trans_read_mem_bytes(mvm->trans, sram_ofs, dump_data->data,
-                                 sram_len);
+        if (sram2_len) {
+                dump_data = iwl_fw_error_next_data(dump_data);
+                dump_data->type = cpu_to_le32(IWL_FW_ERROR_DUMP_MEM);
+                dump_data->len = cpu_to_le32(sram2_len + sizeof(*dump_mem));
+                dump_mem = (void *)dump_data->data;
+                dump_mem->type = cpu_to_le32(IWL_FW_ERROR_DUMP_MEM_SRAM);
+                dump_mem->offset = cpu_to_le32(mvm->cfg->dccm2_offset);
+                iwl_trans_read_mem_bytes(mvm->trans, mvm->cfg->dccm2_offset,
+                                         dump_mem->data, sram2_len);
+        }
 
         fw_error_dump->trans_ptr = iwl_trans_dump_data(mvm->trans);
         fw_error_dump->op_mode_len = file_len;
@@ -864,6 +1052,11 @@ static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
         if (!test_and_clear_bit(IWL_MVM_STATUS_D3_RECONFIG, &mvm->status))
                 iwl_mvm_fw_error_dump(mvm);
 
+        /* cleanup all stale references (scan, roc), but keep the
+         * ucode_down ref until reconfig is complete
+         */
+        iwl_mvm_unref_all_except(mvm, IWL_MVM_REF_UCODE_DOWN);
+
         iwl_trans_stop_device(mvm->trans);
 
         mvm->scan_status = IWL_MVM_SCAN_NONE;
@@ -893,10 +1086,6 @@ static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
 
         ieee80211_wake_queues(mvm->hw);
 
-        /* cleanup all stale references (scan, roc), but keep the
-         * ucode_down ref until reconfig is complete */
-        iwl_mvm_unref_all_except(mvm, IWL_MVM_REF_UCODE_DOWN);
-
         /* clear any stale d0i3 state */
         clear_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status);
 
@@ -933,6 +1122,19 @@ static int iwl_mvm_mac_start(struct ieee80211_hw *hw)
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
         int ret;
 
+        /* Some hw restart cleanups must not hold the mutex */
+        if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
+                /*
+                 * Make sure we are out of d0i3. This is needed
+                 * to make sure the reference accounting is correct
+                 * (and there is no stale d0i3_exit_work).
+                 */
+                wait_event_timeout(mvm->d0i3_exit_waitq,
+                                   !test_bit(IWL_MVM_STATUS_IN_D0I3,
+                                             &mvm->status),
+                                   HZ);
+        }
+
         mutex_lock(&mvm->mutex);
         ret = __iwl_mvm_mac_start(mvm);
         mutex_unlock(&mvm->mutex);
@@ -982,6 +1184,13 @@ static void iwl_mvm_resume_complete(struct iwl_mvm *mvm)
                 IWL_DEBUG_RPM(mvm, "Run deferred d0i3 exit\n");
                 _iwl_mvm_exit_d0i3(mvm);
         }
+
+        if (mvm->trans->d0i3_mode == IWL_D0I3_MODE_ON_SUSPEND)
+                if (!wait_event_timeout(mvm->d0i3_exit_waitq,
+                                        !test_bit(IWL_MVM_STATUS_IN_D0I3,
+                                                  &mvm->status),
+                                        HZ))
+                        WARN_ONCE(1, "D0i3 exit on resume timed out\n");
 }
 
 static void
@@ -1146,7 +1355,7 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
 
         ret = iwl_mvm_power_update_mac(mvm);
         if (ret)
-                goto out_release;
+                goto out_remove_mac;
 
         /* beacon filtering */
         ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
@@ -2088,7 +2297,7 @@ static void iwl_mvm_sta_pre_rcu_remove(struct ieee80211_hw *hw,
                                        struct ieee80211_sta *sta)
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
-        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
 
         /*
          * This is called before mac80211 does RCU synchronisation,
@@ -2105,6 +2314,20 @@ static void iwl_mvm_sta_pre_rcu_remove(struct ieee80211_hw *hw,
         mutex_unlock(&mvm->mutex);
 }
 
+static void iwl_mvm_check_uapsd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                                const u8 *bssid)
+{
+        if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT))
+                return;
+
+        if (iwlwifi_mod_params.uapsd_disable) {
+                vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
+                return;
+        }
+
+        vif->driver_flags |= IEEE80211_VIF_SUPPORTS_UAPSD;
+}
+
 static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
                                  struct ieee80211_vif *vif,
                                  struct ieee80211_sta *sta,
@@ -2164,6 +2387,7 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
                  * Reset EBS status here assuming environment has been changed.
                  */
                 mvm->last_ebs_successful = true;
+                iwl_mvm_check_uapsd(mvm, vif, sta->addr);
                 ret = 0;
         } else if (old_state == IEEE80211_STA_AUTH &&
                    new_state == IEEE80211_STA_ASSOC) {
@@ -3103,7 +3327,7 @@ static int iwl_mvm_set_tim(struct ieee80211_hw *hw,
                            bool set)
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
-        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
 
         if (!mvm_sta || !mvm_sta->vif) {
                 IWL_ERR(mvm, "Station is not associated to a vif\n");
@@ -3343,16 +3567,18 @@ static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,
                 msk |= mvmsta->tfd_queue_msk;
         }
 
-        msk &= ~BIT(vif->hw_queue[IEEE80211_AC_VO]);
-
-        if (iwl_mvm_flush_tx_path(mvm, msk, true))
-                IWL_ERR(mvm, "flush request fail\n");
-        mutex_unlock(&mvm->mutex);
+        if (drop) {
+                if (iwl_mvm_flush_tx_path(mvm, msk, true))
+                        IWL_ERR(mvm, "flush request fail\n");
+                mutex_unlock(&mvm->mutex);
+        } else {
+                mutex_unlock(&mvm->mutex);
 
-        /* this can take a while, and we may need/want other operations
-         * to succeed while doing this, so do it without the mutex held
-         */
-        iwl_trans_wait_tx_queue_empty(mvm->trans, msk);
+                /* this can take a while, and we may need/want other operations
+                 * to succeed while doing this, so do it without the mutex held
+                 */
+                iwl_trans_wait_tx_queue_empty(mvm->trans, msk);
+        }
 }
 
 const struct ieee80211_ops iwl_mvm_hw_ops = {
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index d24660fb4ef2..6c69d0584f6c 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -119,11 +119,13 @@ extern const struct ieee80211_ops iwl_mvm_hw_ops;
  *      We will register to mac80211 to have testmode working. The NIC must not
  *      be up'ed after the INIT fw asserted. This is useful to be able to use
  *      proprietary tools over testmode to debug the INIT fw.
+ * @tfd_q_hang_detect: enabled the detection of hung transmit queues
  * @power_scheme: CAM(Continuous Active Mode)-1, BPS(Balanced Power
  *      Save)-2(default), LP(Low Power)-3
  */
 struct iwl_mvm_mod_params {
         bool init_dbg;
+        bool tfd_q_hang_detect;
         int power_scheme;
 };
 extern struct iwl_mvm_mod_params iwlmvm_mod_params;
@@ -276,6 +278,7 @@ enum iwl_mvm_ref_type {
         IWL_MVM_REF_TM_CMD,
         IWL_MVM_REF_EXIT_WORK,
         IWL_MVM_REF_PROTECT_CSA,
+        IWL_MVM_REF_FW_DBG_COLLECT,
 
         /* update debugfs.c when changing this */
 
@@ -531,10 +534,23 @@ enum {
 enum iwl_mvm_tdls_cs_state {
         IWL_MVM_TDLS_SW_IDLE = 0,
         IWL_MVM_TDLS_SW_REQ_SENT,
+        IWL_MVM_TDLS_SW_RESP_RCVD,
         IWL_MVM_TDLS_SW_REQ_RCVD,
         IWL_MVM_TDLS_SW_ACTIVE,
 };
 
+struct iwl_mvm_shared_mem_cfg {
+        u32 shared_mem_addr;
+        u32 shared_mem_size;
+        u32 sample_buff_addr;
+        u32 sample_buff_size;
+        u32 txfifo_addr;
+        u32 txfifo_size[TX_FIFO_MAX_NUM];
+        u32 rxfifo_size[RX_FIFO_MAX_NUM];
+        u32 page_buff_addr;
+        u32 page_buff_size;
+};
+
 struct iwl_mvm {
         /* for logger access */
         struct device *dev;
@@ -641,6 +657,8 @@ struct iwl_mvm {
         bool disable_power_off;
         bool disable_power_off_d3;
 
+        bool scan_iter_notif_enabled;
+
         struct debugfs_blob_wrapper nvm_hw_blob;
         struct debugfs_blob_wrapper nvm_sw_blob;
         struct debugfs_blob_wrapper nvm_calib_blob;
@@ -782,8 +800,13 @@ struct iwl_mvm {
                         struct cfg80211_chan_def chandef;
                         struct sk_buff *skb; /* ch sw template */
                         u32 ch_sw_tm_ie;
+
+                        /* timestamp of last ch-sw request sent (GP2 time) */
+                        u32 sent_timestamp;
                 } peer;
         } tdls_cs;
+
+        struct iwl_mvm_shared_mem_cfg shared_mem_cfg;
 };
 
 /* Extract MVM priv from op_mode and _hw */
@@ -850,12 +873,14 @@ iwl_mvm_sta_from_staid_protected(struct iwl_mvm *mvm, u8 sta_id)
 static inline bool iwl_mvm_is_d0i3_supported(struct iwl_mvm *mvm)
 {
         return mvm->trans->cfg->d0i3 &&
+               mvm->trans->d0i3_mode != IWL_D0I3_MODE_OFF &&
+               !iwlwifi_mod_params.d0i3_disable &&
                (mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_D0I3_SUPPORT);
 }
 
-static inline bool iwl_mvm_is_dqa_supported(struct iwl_mvm *mvm)
+static inline bool iwl_mvm_is_scd_cfg_supported(struct iwl_mvm *mvm)
 {
-        return mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_DQA_SUPPORT;
+        return mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_SCD_CFG;
 }
 
 extern const u8 iwl_mvm_ac_to_tx_fifo[];
@@ -937,6 +962,33 @@ int iwl_mvm_rx_statistics(struct iwl_mvm *mvm,
 int iwl_nvm_init(struct iwl_mvm *mvm, bool read_nvm_from_nic);
 int iwl_mvm_load_nvm_to_nic(struct iwl_mvm *mvm);
 
+static inline u8 iwl_mvm_get_valid_tx_ant(struct iwl_mvm *mvm)
+{
+        return mvm->nvm_data && mvm->nvm_data->valid_tx_ant ?
+               mvm->fw->valid_tx_ant & mvm->nvm_data->valid_tx_ant :
+               mvm->fw->valid_tx_ant;
+}
+
+static inline u8 iwl_mvm_get_valid_rx_ant(struct iwl_mvm *mvm)
+{
+        return mvm->nvm_data && mvm->nvm_data->valid_rx_ant ?
+               mvm->fw->valid_rx_ant & mvm->nvm_data->valid_rx_ant :
+               mvm->fw->valid_rx_ant;
+}
+
+static inline u32 iwl_mvm_get_phy_config(struct iwl_mvm *mvm)
+{
+        u32 phy_config = ~(FW_PHY_CFG_TX_CHAIN |
+                           FW_PHY_CFG_RX_CHAIN);
+        u32 valid_rx_ant = iwl_mvm_get_valid_rx_ant(mvm);
+        u32 valid_tx_ant = iwl_mvm_get_valid_tx_ant(mvm);
+
+        phy_config |= valid_tx_ant << FW_PHY_CFG_TX_CHAIN_POS |
+                      valid_rx_ant << FW_PHY_CFG_RX_CHAIN_POS;
+
+        return mvm->fw->phy_config & phy_config;
+}
+
 int iwl_mvm_up(struct iwl_mvm *mvm);
 int iwl_mvm_load_d3_fw(struct iwl_mvm *mvm);
 
@@ -970,6 +1022,9 @@ int iwl_mvm_rx_radio_ver(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
                          struct iwl_device_cmd *cmd);
 int iwl_mvm_rx_mfuart_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
                             struct iwl_device_cmd *cmd);
+int iwl_mvm_rx_shared_mem_cfg_notif(struct iwl_mvm *mvm,
+                                    struct iwl_rx_cmd_buffer *rxb,
+                                    struct iwl_device_cmd *cmd);
 
 /* MVM PHY */
 int iwl_mvm_phy_ctxt_add(struct iwl_mvm *mvm, struct iwl_mvm_phy_ctxt *ctxt,
@@ -1031,6 +1086,9 @@ int iwl_mvm_max_scan_ie_len(struct iwl_mvm *mvm, bool is_sched_scan);
 int iwl_mvm_rx_scan_offload_complete_notif(struct iwl_mvm *mvm,
                                            struct iwl_rx_cmd_buffer *rxb,
                                            struct iwl_device_cmd *cmd);
+int iwl_mvm_rx_scan_offload_iter_complete_notif(struct iwl_mvm *mvm,
+                                                struct iwl_rx_cmd_buffer *rxb,
+                                                struct iwl_device_cmd *cmd);
 int iwl_mvm_config_sched_scan(struct iwl_mvm *mvm,
                               struct ieee80211_vif *vif,
                               struct cfg80211_sched_scan_request *req,
@@ -1091,9 +1149,7 @@ iwl_mvm_vif_dbgfs_clean(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 
 /* rate scaling */
 int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq, bool init);
-void iwl_mvm_update_frame_stats(struct iwl_mvm *mvm,
-                                struct iwl_mvm_frame_stats *stats,
-                                u32 rate, bool agg);
+void iwl_mvm_update_frame_stats(struct iwl_mvm *mvm, u32 rate, bool agg);
 int rs_pretty_print_rate(char *buf, const u32 rate);
 void rs_update_last_rssi(struct iwl_mvm *mvm,
                          struct iwl_lq_sta *lq_sta,
@@ -1159,6 +1215,8 @@ void iwl_mvm_unref(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type);
 int iwl_mvm_ref_sync(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type);
 bool iwl_mvm_ref_taken(struct iwl_mvm *mvm);
 void iwl_mvm_d0i3_enable_tx(struct iwl_mvm *mvm, __le16 *qos_seq);
+int iwl_mvm_enter_d0i3(struct iwl_op_mode *op_mode);
+int iwl_mvm_exit_d0i3(struct iwl_op_mode *op_mode);
 int _iwl_mvm_exit_d0i3(struct iwl_mvm *mvm);
 
 /* BT Coex */
@@ -1260,11 +1318,13 @@ static inline bool iwl_mvm_vif_low_latency(struct iwl_mvm_vif *mvmvif)
 
 /* hw scheduler queue config */
 void iwl_mvm_enable_txq(struct iwl_mvm *mvm, int queue, u16 ssn,
-                        const struct iwl_trans_txq_scd_cfg *cfg);
-void iwl_mvm_disable_txq(struct iwl_mvm *mvm, int queue);
+                        const struct iwl_trans_txq_scd_cfg *cfg,
+                        unsigned int wdg_timeout);
+void iwl_mvm_disable_txq(struct iwl_mvm *mvm, int queue, u8 flags);
 
-static inline void iwl_mvm_enable_ac_txq(struct iwl_mvm *mvm, int queue,
-                                         u8 fifo)
+static inline
+void iwl_mvm_enable_ac_txq(struct iwl_mvm *mvm, int queue,
+                           u8 fifo, unsigned int wdg_timeout)
 {
         struct iwl_trans_txq_scd_cfg cfg = {
                 .fifo = fifo,
@@ -1273,12 +1333,13 @@ static inline void iwl_mvm_enable_ac_txq(struct iwl_mvm *mvm, int queue,
                 .frame_limit = IWL_FRAME_LIMIT,
         };
 
-        iwl_mvm_enable_txq(mvm, queue, 0, &cfg);
+        iwl_mvm_enable_txq(mvm, queue, 0, &cfg, wdg_timeout);
 }
 
 static inline void iwl_mvm_enable_agg_txq(struct iwl_mvm *mvm, int queue,
                                           int fifo, int sta_id, int tid,
-                                          int frame_limit, u16 ssn)
+                                          int frame_limit, u16 ssn,
+                                          unsigned int wdg_timeout)
 {
         struct iwl_trans_txq_scd_cfg cfg = {
                 .fifo = fifo,
@@ -1288,7 +1349,7 @@ static inline void iwl_mvm_enable_agg_txq(struct iwl_mvm *mvm, int queue,
                 .aggregate = true,
         };
 
-        iwl_mvm_enable_txq(mvm, queue, ssn, &cfg);
+        iwl_mvm_enable_txq(mvm, queue, ssn, &cfg, wdg_timeout);
 }
 
 /* Assoc status */
@@ -1344,4 +1405,7 @@ struct ieee80211_vif *iwl_mvm_get_bss_vif(struct iwl_mvm *mvm);
 void iwl_mvm_nic_restart(struct iwl_mvm *mvm, bool fw_error);
 void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm);
 
+int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm, enum iwl_fw_dbg_conf id);
+void iwl_mvm_fw_dbg_collect(struct iwl_mvm *mvm);
+
 #endif /* __IWL_MVM_H__ */
diff --git a/drivers/net/wireless/iwlwifi/mvm/nvm.c b/drivers/net/wireless/iwlwifi/mvm/nvm.c
index d55fd8e3654c..5383429d96c1 100644
--- a/drivers/net/wireless/iwlwifi/mvm/nvm.c
+++ b/drivers/net/wireless/iwlwifi/mvm/nvm.c
@@ -356,7 +356,7 @@ static int iwl_mvm_read_external_nvm(struct iwl_mvm *mvm)
                 max_section_size = IWL_MAX_NVM_SECTION_SIZE;
         else if (CSR_HW_REV_STEP(mvm->trans->hw_rev) == SILICON_A_STEP)
                 max_section_size = IWL_MAX_NVM_8000A_SECTION_SIZE;
-        else /* Family 8000 B-step */
+        else /* Family 8000 B-step or C-step */
                 max_section_size = IWL_MAX_NVM_8000B_SECTION_SIZE;
 
         /*
@@ -565,6 +565,8 @@ int iwl_nvm_init(struct iwl_mvm *mvm, bool read_nvm_from_nic)
         mvm->nvm_data = iwl_parse_nvm_sections(mvm);
         if (!mvm->nvm_data)
                 return -ENODATA;
+        IWL_DEBUG_EEPROM(mvm->trans->dev, "nvm version = %x\n",
+                         mvm->nvm_data->nvm_version);
 
         return 0;
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwlwifi/mvm/ops.c
index 97dfba50c682..2dffc3600ed3 100644
--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
@@ -84,15 +84,8 @@
 #include "time-event.h"
 #include "iwl-fw-error-dump.h"
 
-/*
- * module name, copyright, version, etc.
- */
 #define DRV_DESCRIPTION "The new Intel(R) wireless AGN driver for Linux"
-
-#define DRV_VERSION     IWLWIFI_VERSION
-
 MODULE_DESCRIPTION(DRV_DESCRIPTION);
-MODULE_VERSION(DRV_VERSION);
 MODULE_AUTHOR(DRV_COPYRIGHT " " DRV_AUTHOR);
 MODULE_LICENSE("GPL");
 
@@ -100,6 +93,7 @@ static const struct iwl_op_mode_ops iwl_mvm_ops;
 
 struct iwl_mvm_mod_params iwlmvm_mod_params = {
         .power_scheme = IWL_POWER_SCHEME_BPS,
+        .tfd_q_hang_detect = true
         /* rest of fields are 0 by default */
 };
 
@@ -109,6 +103,10 @@ MODULE_PARM_DESC(init_dbg,
 module_param_named(power_scheme, iwlmvm_mod_params.power_scheme, int, S_IRUGO);
 MODULE_PARM_DESC(power_scheme,
                  "power management scheme: 1-active, 2-balanced, 3-low power, default: 2");
+module_param_named(tfd_q_hang_detect, iwlmvm_mod_params.tfd_q_hang_detect,
+                   bool, S_IRUGO);
+MODULE_PARM_DESC(tfd_q_hang_detect,
+                 "TFD queues hang detection (default: true");
 
 /*
  * module init and exit functions
@@ -146,13 +144,14 @@ static void iwl_mvm_nic_config(struct iwl_op_mode *op_mode)
         struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
         u8 radio_cfg_type, radio_cfg_step, radio_cfg_dash;
         u32 reg_val = 0;
+        u32 phy_config = iwl_mvm_get_phy_config(mvm);
 
-        radio_cfg_type = (mvm->fw->phy_config & FW_PHY_CFG_RADIO_TYPE) >>
-                          FW_PHY_CFG_RADIO_TYPE_POS;
-        radio_cfg_step = (mvm->fw->phy_config & FW_PHY_CFG_RADIO_STEP) >>
-                          FW_PHY_CFG_RADIO_STEP_POS;
-        radio_cfg_dash = (mvm->fw->phy_config & FW_PHY_CFG_RADIO_DASH) >>
-                          FW_PHY_CFG_RADIO_DASH_POS;
+        radio_cfg_type = (phy_config & FW_PHY_CFG_RADIO_TYPE) >>
+                         FW_PHY_CFG_RADIO_TYPE_POS;
+        radio_cfg_step = (phy_config & FW_PHY_CFG_RADIO_STEP) >>
+                         FW_PHY_CFG_RADIO_STEP_POS;
+        radio_cfg_dash = (phy_config & FW_PHY_CFG_RADIO_DASH) >>
+                         FW_PHY_CFG_RADIO_DASH_POS;
 
         /* SKU control */
         reg_val |= CSR_HW_REV_STEP(mvm->trans->hw_rev) <<
@@ -240,6 +239,8 @@ static const struct iwl_rx_handlers iwl_mvm_rx_handlers[] = {
 
         RX_HANDLER(SCAN_REQUEST_CMD, iwl_mvm_rx_scan_response, false),
         RX_HANDLER(SCAN_COMPLETE_NOTIFICATION, iwl_mvm_rx_scan_complete, true),
+        RX_HANDLER(SCAN_ITERATION_COMPLETE,
+                   iwl_mvm_rx_scan_offload_iter_complete_notif, false),
         RX_HANDLER(SCAN_OFFLOAD_COMPLETE,
                    iwl_mvm_rx_scan_offload_complete_notif, true),
         RX_HANDLER(MATCH_FOUND_NOTIFICATION, iwl_mvm_rx_scan_offload_results,
@@ -274,6 +275,7 @@ static const char *const iwl_mvm_cmd_strings[REPLY_MAX] = {
         CMD(MGMT_MCAST_KEY),
         CMD(TX_CMD),
         CMD(TXPATH_FLUSH),
+        CMD(SHARED_MEM_CFG),
         CMD(MAC_CONTEXT_CMD),
         CMD(TIME_EVENT_CMD),
         CMD(TIME_EVENT_NOTIFICATION),
@@ -476,17 +478,19 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_DW_BC_TABLE)
                 trans_cfg.bc_table_dword = true;
 
-        if (!iwlwifi_mod_params.wd_disable)
-                trans_cfg.queue_watchdog_timeout = cfg->base_params->wd_timeout;
-        else
-                trans_cfg.queue_watchdog_timeout = IWL_WATCHDOG_DISABLED;
-
         trans_cfg.command_names = iwl_mvm_cmd_strings;
 
         trans_cfg.cmd_queue = IWL_MVM_CMD_QUEUE;
         trans_cfg.cmd_fifo = IWL_MVM_TX_FIFO_CMD;
         trans_cfg.scd_set_active = true;
 
+        trans_cfg.sdio_adma_addr = fw->sdio_adma_addr;
+
+        /* Set a short watchdog for the command queue */
+        trans_cfg.cmd_q_wdg_timeout =
+                iwlmvm_mod_params.tfd_q_hang_detect ? IWL_DEF_WD_TIMEOUT :
+                                                      IWL_WATCHDOG_DISABLED;
+
         snprintf(mvm->hw->wiphy->fw_version,
                  sizeof(mvm->hw->wiphy->fw_version),
                  "%s", fw->fw_version);
@@ -517,10 +521,15 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         min_backoff = calc_min_backoff(trans, cfg);
         iwl_mvm_tt_initialize(mvm, min_backoff);
         /* set the nvm_file_name according to priority */
-        if (iwlwifi_mod_params.nvm_file)
+        if (iwlwifi_mod_params.nvm_file) {
                 mvm->nvm_file_name = iwlwifi_mod_params.nvm_file;
-        else
-                mvm->nvm_file_name = mvm->cfg->default_nvm_file;
+        } else {
+                if ((trans->cfg->device_family == IWL_DEVICE_FAMILY_8000) &&
+                    (CSR_HW_REV_STEP(trans->hw_rev) == SILICON_A_STEP))
+                        mvm->nvm_file_name = mvm->cfg->default_nvm_file_8000A;
+                else
+                        mvm->nvm_file_name = mvm->cfg->default_nvm_file;
+        }
 
         if (WARN(cfg->no_power_up_nic_in_init && !mvm->nvm_file_name,
                  "not allowing power-up and not having nvm_file\n"))
@@ -559,6 +568,9 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         if (!mvm->scan_cmd)
                 goto out_free;
 
+        /* Set EBS as successful as long as not stated otherwise by the FW. */
+        mvm->last_ebs_successful = true;
+
         err = iwl_mvm_mac_setup_register(mvm);
         if (err)
                 goto out_free;
@@ -817,9 +829,20 @@ static void iwl_mvm_fw_error_dump_wk(struct work_struct *work)
         struct iwl_mvm *mvm =
                 container_of(work, struct iwl_mvm, fw_error_dump_wk);
 
+        if (iwl_mvm_ref_sync(mvm, IWL_MVM_REF_FW_DBG_COLLECT))
+                return;
+
         mutex_lock(&mvm->mutex);
         iwl_mvm_fw_error_dump(mvm);
+
+        /* start recording again if the firmware is not crashed */
+        WARN_ON_ONCE((!test_bit(STATUS_FW_ERROR, &mvm->trans->status)) &&
+                      mvm->fw->dbg_dest_tlv &&
+                      iwl_mvm_start_fw_dbg_conf(mvm, mvm->fw_dbg_conf));
+
         mutex_unlock(&mvm->mutex);
+
+        iwl_mvm_unref(mvm, IWL_MVM_REF_FW_DBG_COLLECT);
 }
 
 void iwl_mvm_nic_restart(struct iwl_mvm *mvm, bool fw_error)
@@ -855,7 +878,10 @@ void iwl_mvm_nic_restart(struct iwl_mvm *mvm, bool fw_error)
          * If WoWLAN fw asserted, don't restart either, mac80211
          * can't recover this since we're already half suspended.
          */
-        if (test_and_set_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
+        if (!mvm->restart_fw && fw_error) {
+                schedule_work(&mvm->fw_error_dump_wk);
+        } else if (test_and_set_bit(IWL_MVM_STATUS_IN_HW_RESTART,
+                                    &mvm->status)) {
                 struct iwl_mvm_reprobe *reprobe;
 
                 IWL_ERR(mvm,
@@ -879,16 +905,13 @@ void iwl_mvm_nic_restart(struct iwl_mvm *mvm, bool fw_error)
                 reprobe->dev = mvm->trans->dev;
                 INIT_WORK(&reprobe->work, iwl_mvm_reprobe_wk);
                 schedule_work(&reprobe->work);
-        } else if (mvm->cur_ucode == IWL_UCODE_REGULAR &&
-                   (!fw_error || mvm->restart_fw)) {
+        } else if (mvm->cur_ucode == IWL_UCODE_REGULAR) {
                 /* don't let the transport/FW power down */
                 iwl_mvm_ref(mvm, IWL_MVM_REF_UCODE_DOWN);
 
                 if (fw_error && mvm->restart_fw > 0)
                         mvm->restart_fw--;
                 ieee80211_restart_hw(mvm->hw);
-        } else if (fw_error) {
-                schedule_work(&mvm->fw_error_dump_wk);
         }
 }
 
@@ -1031,7 +1054,8 @@ static void iwl_mvm_set_wowlan_data(struct iwl_mvm *mvm,
 out:
         rcu_read_unlock();
 }
-static int iwl_mvm_enter_d0i3(struct iwl_op_mode *op_mode)
+
+int iwl_mvm_enter_d0i3(struct iwl_op_mode *op_mode)
 {
         struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
         u32 flags = CMD_ASYNC | CMD_HIGH_PRIO | CMD_SEND_IN_IDLE;
@@ -1047,6 +1071,7 @@ static int iwl_mvm_enter_d0i3(struct iwl_op_mode *op_mode)
         };
         struct iwl_d3_manager_config d3_cfg_cmd = {
                 .min_sleep_time = cpu_to_le32(1000),
+                .wakeup_flags = cpu_to_le32(IWL_WAKEUP_D3_CONFIG_FW_ERROR),
         };
 
         IWL_DEBUG_RPM(mvm, "MVM entering D0i3\n");
@@ -1146,7 +1171,7 @@ void iwl_mvm_d0i3_enable_tx(struct iwl_mvm *mvm, __le16 *qos_seq)
 
         if (mvm->d0i3_offloading && qos_seq) {
                 /* update qos seq numbers if offloading was enabled */
-                mvm_ap_sta = (struct iwl_mvm_sta *)sta->drv_priv;
+                mvm_ap_sta = iwl_mvm_sta_from_mac80211(sta);
                 for (i = 0; i < IWL_MAX_TID_COUNT; i++) {
                         u16 seq = le16_to_cpu(qos_seq[i]);
                         /* firmware stores last-used one, we store next one */
@@ -1245,7 +1270,7 @@ out:
         return ret;
 }
 
-static int iwl_mvm_exit_d0i3(struct iwl_op_mode *op_mode)
+int iwl_mvm_exit_d0i3(struct iwl_op_mode *op_mode)
 {
         struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c b/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
index 1c0d4a45c1a8..5b43616eeb06 100644
--- a/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
@@ -170,13 +170,13 @@ static void iwl_mvm_phy_ctxt_cmd_data(struct iwl_mvm *mvm,
                 active_cnt = 2;
         }
 
-        cmd->rxchain_info = cpu_to_le32(mvm->fw->valid_rx_ant <<
+        cmd->rxchain_info = cpu_to_le32(iwl_mvm_get_valid_rx_ant(mvm) <<
                                         PHY_RX_CHAIN_VALID_POS);
         cmd->rxchain_info |= cpu_to_le32(idle_cnt << PHY_RX_CHAIN_CNT_POS);
         cmd->rxchain_info |= cpu_to_le32(active_cnt <<
                                          PHY_RX_CHAIN_MIMO_CNT_POS);
 
-        cmd->txchain_info = cpu_to_le32(mvm->fw->valid_tx_ant);
+        cmd->txchain_info = cpu_to_le32(iwl_mvm_get_valid_tx_ant(mvm));
 }
 
 /*
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c
index 30ceb67ed7a7..194bd1f939ca 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
@@ -39,28 +39,16 @@
 #include "sta.h"
 #include "iwl-op-mode.h"
 #include "mvm.h"
+#include "debugfs.h"
 
 #define RS_NAME "iwl-mvm-rs"
 
-#define NUM_TRY_BEFORE_ANT_TOGGLE       1
-#define RS_LEGACY_RETRIES_PER_RATE      1
-#define RS_HT_VHT_RETRIES_PER_RATE      2
-#define RS_HT_VHT_RETRIES_PER_RATE_TW   1
-#define RS_INITIAL_MIMO_NUM_RATES       3
-#define RS_INITIAL_SISO_NUM_RATES       3
-#define RS_INITIAL_LEGACY_NUM_RATES     LINK_QUAL_MAX_RETRY_NUM
-#define RS_SECONDARY_LEGACY_NUM_RATES   LINK_QUAL_MAX_RETRY_NUM
-#define RS_SECONDARY_SISO_NUM_RATES     3
-#define RS_SECONDARY_SISO_RETRIES       1
-
 #define IWL_RATE_MAX_WINDOW             62      /* # tx in history window */
-#define IWL_RATE_MIN_FAILURE_TH         3       /* min failures to calc tpt */
-#define IWL_RATE_MIN_SUCCESS_TH         8       /* min successes to calc tpt */
 
-/* max allowed rate miss before sync LQ cmd */
-#define IWL_MISSED_RATE_MAX             15
-#define RS_STAY_IN_COLUMN_TIMEOUT       (5*HZ)
-#define RS_IDLE_TIMEOUT                 (5*HZ)
+/* Calculations of success ratio are done in fixed point where 12800 is 100%.
+ * Use this macro when dealing with thresholds consts set as a percentage
+ */
+#define RS_PERCENT(x) (128 * x)
 
 static u8 rs_ht_to_legacy[] = {
         [IWL_RATE_MCS_0_INDEX] = IWL_RATE_6M_INDEX,
@@ -173,7 +161,7 @@ static bool rs_mimo_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         if (sta->smps_mode == IEEE80211_SMPS_STATIC)
                 return false;
 
-        if (num_of_ant(mvm->fw->valid_tx_ant) < 2)
+        if (num_of_ant(iwl_mvm_get_valid_tx_ant(mvm)) < 2)
                 return false;
 
         if (!iwl_mvm_bt_coex_is_mimo_allowed(mvm, sta))
@@ -613,7 +601,8 @@ static s32 get_expected_tpt(struct iwl_scale_tbl_info *tbl, int rs_index)
  * at this rate.  window->data contains the bitmask of successful
  * packets.
  */
-static int _rs_collect_tx_data(struct iwl_scale_tbl_info *tbl,
+static int _rs_collect_tx_data(struct iwl_mvm *mvm,
+                               struct iwl_scale_tbl_info *tbl,
                                int scale_index, int attempts, int successes,
                                struct iwl_rate_scale_data *window)
 {
@@ -668,8 +657,8 @@ static int _rs_collect_tx_data(struct iwl_scale_tbl_info *tbl,
         fail_count = window->counter - window->success_counter;
 
         /* Calculate average throughput, if we have enough history. */
-        if ((fail_count >= IWL_RATE_MIN_FAILURE_TH) ||
-            (window->success_counter >= IWL_RATE_MIN_SUCCESS_TH))
+        if ((fail_count >= IWL_MVM_RS_RATE_MIN_FAILURE_TH) ||
+            (window->success_counter >= IWL_MVM_RS_RATE_MIN_SUCCESS_TH))
                 window->average_tpt = (window->success_ratio * tpt + 64) / 128;
         else
                 window->average_tpt = IWL_INVALID_VALUE;
@@ -677,7 +666,8 @@ static int _rs_collect_tx_data(struct iwl_scale_tbl_info *tbl,
         return 0;
 }
 
-static int rs_collect_tx_data(struct iwl_lq_sta *lq_sta,
+static int rs_collect_tx_data(struct iwl_mvm *mvm,
+                              struct iwl_lq_sta *lq_sta,
                               struct iwl_scale_tbl_info *tbl,
                               int scale_index, int attempts, int successes,
                               u8 reduced_txp)
@@ -698,7 +688,7 @@ static int rs_collect_tx_data(struct iwl_lq_sta *lq_sta,
         /* Select window for current tx bit rate */
         window = &(tbl->win[scale_index]);
 
-        ret = _rs_collect_tx_data(tbl, scale_index, attempts, successes,
+        ret = _rs_collect_tx_data(mvm, tbl, scale_index, attempts, successes,
                                   window);
         if (ret)
                 return ret;
@@ -707,7 +697,7 @@ static int rs_collect_tx_data(struct iwl_lq_sta *lq_sta,
                 return -EINVAL;
 
         window = &tbl->tpc_win[reduced_txp];
-        return _rs_collect_tx_data(tbl, scale_index, attempts, successes,
+        return _rs_collect_tx_data(mvm, tbl, scale_index, attempts, successes,
                                    window);
 }
 
@@ -928,7 +918,6 @@ static u16 rs_get_adjacent_rate(struct iwl_mvm *mvm, u8 index, u16 rate_mask,
                         break;
                 if (rate_mask & (1 << low))
                         break;
-                IWL_DEBUG_RATE(mvm, "Skipping masked lower rate: %d\n", low);
         }
 
         high = index;
@@ -938,7 +927,6 @@ static u16 rs_get_adjacent_rate(struct iwl_mvm *mvm, u8 index, u16 rate_mask,
                         break;
                 if (rate_mask & (1 << high))
                         break;
-                IWL_DEBUG_RATE(mvm, "Skipping masked higher rate: %d\n", high);
         }
 
         return (high << 8) | low;
@@ -1004,7 +992,7 @@ static void rs_get_lower_rate_down_column(struct iwl_lq_sta *lq_sta,
         }
 
         if (num_of_ant(rate->ant) > 1)
-                rate->ant = first_antenna(mvm->fw->valid_tx_ant);
+                rate->ant = first_antenna(iwl_mvm_get_valid_tx_ant(mvm));
 
         /* Relevant in both switching to SISO or Legacy */
         rate->sgi = false;
@@ -1125,7 +1113,8 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         }
 
         if (time_after(jiffies,
-                       (unsigned long)(lq_sta->last_tx + RS_IDLE_TIMEOUT))) {
+                       (unsigned long)(lq_sta->last_tx +
+                                       (IWL_MVM_RS_IDLE_TIMEOUT * HZ)))) {
                 int t;
 
                 IWL_DEBUG_RATE(mvm, "Tx idle for too long. reinit rs\n");
@@ -1158,7 +1147,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                  * ... driver.
                  */
                 lq_sta->missed_rate_counter++;
-                if (lq_sta->missed_rate_counter > IWL_MISSED_RATE_MAX) {
+                if (lq_sta->missed_rate_counter > IWL_MVM_RS_MISSED_RATE_MAX) {
                         lq_sta->missed_rate_counter = 0;
                         IWL_DEBUG_RATE(mvm,
                                        "Too many rates mismatch. Send sync LQ. rs_state %d\n",
@@ -1213,7 +1202,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 
                 ucode_rate = le32_to_cpu(table->rs_table[0]);
                 rs_rate_from_ucode_rate(ucode_rate, info->band, &rate);
-                rs_collect_tx_data(lq_sta, curr_tbl, rate.index,
+                rs_collect_tx_data(mvm, lq_sta, curr_tbl, rate.index,
                                    info->status.ampdu_len,
                                    info->status.ampdu_ack_len,
                                    reduced_txp);
@@ -1249,7 +1238,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                         else
                                 continue;
 
-                        rs_collect_tx_data(lq_sta, tmp_tbl, rate.index, 1,
+                        rs_collect_tx_data(mvm, lq_sta, tmp_tbl, rate.index, 1,
                                            i < retries ? 0 : legacy_success,
                                            reduced_txp);
                 }
@@ -1303,13 +1292,13 @@ static void rs_set_stay_in_table(struct iwl_mvm *mvm, u8 is_legacy,
         IWL_DEBUG_RATE(mvm, "Moving to RS_STATE_STAY_IN_COLUMN\n");
         lq_sta->rs_state = RS_STATE_STAY_IN_COLUMN;
         if (is_legacy) {
-                lq_sta->table_count_limit = IWL_LEGACY_TABLE_COUNT;
-                lq_sta->max_failure_limit = IWL_LEGACY_FAILURE_LIMIT;
-                lq_sta->max_success_limit = IWL_LEGACY_SUCCESS_LIMIT;
+                lq_sta->table_count_limit = IWL_MVM_RS_LEGACY_TABLE_COUNT;
+                lq_sta->max_failure_limit = IWL_MVM_RS_LEGACY_FAILURE_LIMIT;
+                lq_sta->max_success_limit = IWL_MVM_RS_LEGACY_SUCCESS_LIMIT;
         } else {
-                lq_sta->table_count_limit = IWL_NONE_LEGACY_TABLE_COUNT;
-                lq_sta->max_failure_limit = IWL_NONE_LEGACY_FAILURE_LIMIT;
-                lq_sta->max_success_limit = IWL_NONE_LEGACY_SUCCESS_LIMIT;
+                lq_sta->table_count_limit = IWL_MVM_RS_NON_LEGACY_TABLE_COUNT;
+                lq_sta->max_failure_limit = IWL_MVM_RS_NON_LEGACY_FAILURE_LIMIT;
+                lq_sta->max_success_limit = IWL_MVM_RS_NON_LEGACY_SUCCESS_LIMIT;
         }
         lq_sta->table_count = 0;
         lq_sta->total_failed = 0;
@@ -1318,6 +1307,13 @@ static void rs_set_stay_in_table(struct iwl_mvm *mvm, u8 is_legacy,
         lq_sta->visited_columns = 0;
 }
 
+static inline int rs_get_max_rate_from_mask(unsigned long rate_mask)
+{
+        if (rate_mask)
+                return find_last_bit(&rate_mask, BITS_PER_LONG);
+        return IWL_RATE_INVALID;
+}
+
 static int rs_get_max_allowed_rate(struct iwl_lq_sta *lq_sta,
                                    const struct rs_tx_column *column)
 {
@@ -1420,7 +1416,7 @@ static s32 rs_get_best_rate(struct iwl_mvm *mvm,
         u32 target_tpt;
         int rate_idx;
 
-        if (success_ratio > RS_SR_NO_DECREASE) {
+        if (success_ratio > IWL_MVM_RS_SR_NO_DECREASE) {
                 target_tpt = 100 * expected_current_tpt;
                 IWL_DEBUG_RATE(mvm,
                                "SR %d high. Find rate exceeding EXPECTED_CURRENT %d\n",
@@ -1488,7 +1484,7 @@ static void rs_stay_in_table(struct iwl_lq_sta *lq_sta, bool force_search)
                         flush_interval_passed =
                                 time_after(jiffies,
                                            (unsigned long)(lq_sta->flush_timer +
-                                                RS_STAY_IN_COLUMN_TIMEOUT));
+                                                           (IWL_MVM_RS_STAY_IN_COLUMN_TIMEOUT * HZ)));
 
                 /*
                  * Check if we should allow search for new modulation mode.
@@ -1567,7 +1563,7 @@ static enum rs_column rs_get_next_column(struct iwl_mvm *mvm,
         const struct rs_tx_column *curr_col = &rs_tx_columns[tbl->column];
         const struct rs_tx_column *next_col;
         allow_column_func_t allow_func;
-        u8 valid_ants = mvm->fw->valid_tx_ant;
+        u8 valid_ants = iwl_mvm_get_valid_tx_ant(mvm);
         const u16 *expected_tpt_tbl;
         u16 tpt, max_expected_tpt;
 
@@ -1613,8 +1609,12 @@ static enum rs_column rs_get_next_column(struct iwl_mvm *mvm,
                         continue;
 
                 max_rate = rs_get_max_allowed_rate(lq_sta, next_col);
-                if (WARN_ON_ONCE(max_rate == IWL_RATE_INVALID))
+                if (max_rate == IWL_RATE_INVALID) {
+                        IWL_DEBUG_RATE(mvm,
+                                       "Skip column %d: no rate is allowed in this column\n",
+                                       next_col_id);
                         continue;
+                }
 
                 max_expected_tpt = expected_tpt_tbl[max_rate];
                 if (tpt >= max_expected_tpt) {
@@ -1724,7 +1724,8 @@ static enum rs_action rs_get_rate_action(struct iwl_mvm *mvm,
 {
         enum rs_action action = RS_ACTION_STAY;
 
-        if ((sr <= RS_SR_FORCE_DECREASE) || (current_tpt == 0)) {
+        if ((sr <= RS_PERCENT(IWL_MVM_RS_SR_FORCE_DECREASE)) ||
+            (current_tpt == 0)) {
                 IWL_DEBUG_RATE(mvm,
                                "Decrease rate because of low SR\n");
                 return RS_ACTION_DOWNSCALE;
@@ -1783,7 +1784,7 @@ static enum rs_action rs_get_rate_action(struct iwl_mvm *mvm,
 
 out:
         if ((action == RS_ACTION_DOWNSCALE) && (low != IWL_RATE_INVALID)) {
-                if (sr >= RS_SR_NO_DECREASE) {
+                if (sr >= RS_PERCENT(IWL_MVM_RS_SR_NO_DECREASE)) {
                         IWL_DEBUG_RATE(mvm,
                                        "SR is above NO DECREASE. Avoid downscale\n");
                         action = RS_ACTION_STAY;
@@ -1802,18 +1803,10 @@ out:
 static bool rs_stbc_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                           struct iwl_lq_sta *lq_sta)
 {
-        struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
-        struct ieee80211_vif *vif = mvmsta->vif;
-        bool sta_ps_disabled = (vif->type == NL80211_IFTYPE_STATION &&
-                                !vif->bss_conf.ps);
-
         /* Our chip supports Tx STBC and the peer is an HT/VHT STA which
          * supports STBC of at least 1*SS
          */
-        if (!lq_sta->stbc)
-                return false;
-
-        if (!mvm->ps_disabled && !sta_ps_disabled)
+        if (!lq_sta->stbc_capable)
                 return false;
 
         if (!iwl_mvm_bt_coex_is_mimo_allowed(mvm, sta))
@@ -1825,11 +1818,11 @@ static bool rs_stbc_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 static void rs_get_adjacent_txp(struct iwl_mvm *mvm, int index,
                                 int *weaker, int *stronger)
 {
-        *weaker = index + TPC_TX_POWER_STEP;
+        *weaker = index + IWL_MVM_RS_TPC_TX_POWER_STEP;
         if (*weaker > TPC_MAX_REDUCTION)
                 *weaker = TPC_INVALID;
 
-        *stronger = index - TPC_TX_POWER_STEP;
+        *stronger = index - IWL_MVM_RS_TPC_TX_POWER_STEP;
         if (*stronger < 0)
                 *stronger = TPC_INVALID;
 }
@@ -1885,7 +1878,8 @@ static enum tpc_action rs_get_tpc_action(struct iwl_mvm *mvm,
         }
 
         /* Too many failures, increase txp */
-        if (sr <= TPC_SR_FORCE_INCREASE || current_tpt == 0) {
+        if (sr <= RS_PERCENT(IWL_MVM_RS_TPC_SR_FORCE_INCREASE) ||
+            current_tpt == 0) {
                 IWL_DEBUG_RATE(mvm, "increase txp because of weak SR\n");
                 return TPC_ACTION_NO_RESTIRCTION;
         }
@@ -1908,7 +1902,8 @@ static enum tpc_action rs_get_tpc_action(struct iwl_mvm *mvm,
         }
 
         /* next, increase if needed */
-        if (sr < TPC_SR_NO_INCREASE && strong != TPC_INVALID) {
+        if (sr < RS_PERCENT(IWL_MVM_RS_TPC_SR_NO_INCREASE) &&
+            strong != TPC_INVALID) {
                 if (weak_tpt == IWL_INVALID_VALUE &&
                     strong_tpt != IWL_INVALID_VALUE &&
                     current_tpt < strong_tpt) {
@@ -1935,7 +1930,7 @@ static bool rs_tpc_perform(struct iwl_mvm *mvm,
                            struct iwl_lq_sta *lq_sta,
                            struct iwl_scale_tbl_info *tbl)
 {
-        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
         struct ieee80211_vif *vif = mvm_sta->vif;
         struct ieee80211_chanctx_conf *chanctx_conf;
         enum ieee80211_band band;
@@ -2044,7 +2039,7 @@ static void rs_rate_scale_perform(struct iwl_mvm *mvm,
         u16 high_low;
         s32 sr;
         u8 prev_agg = lq_sta->is_agg;
-        struct iwl_mvm_sta *sta_priv = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *sta_priv = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_mvm_tid_data *tid_data;
         struct rs_rate *rate;
 
@@ -2106,8 +2101,8 @@ static void rs_rate_scale_perform(struct iwl_mvm *mvm,
          * in current association (use new rate found above).
          */
         fail_count = window->counter - window->success_counter;
-        if ((fail_count < IWL_RATE_MIN_FAILURE_TH) &&
-            (window->success_counter < IWL_RATE_MIN_SUCCESS_TH)) {
+        if ((fail_count < IWL_MVM_RS_RATE_MIN_FAILURE_TH) &&
+            (window->success_counter < IWL_MVM_RS_RATE_MIN_SUCCESS_TH)) {
                 IWL_DEBUG_RATE(mvm,
                                "(%s: %d): Test Window: succ %d total %d\n",
                                rs_pretty_lq_type(rate->type),
@@ -2385,7 +2380,7 @@ static void rs_get_initial_rate(struct iwl_mvm *mvm,
         int i, nentries;
         s8 best_rssi = S8_MIN;
         u8 best_ant = ANT_NONE;
-        u8 valid_tx_ant = mvm->fw->valid_tx_ant;
+        u8 valid_tx_ant = iwl_mvm_get_valid_tx_ant(mvm);
         const struct rs_init_rate_info *initial_rates;
 
         for (i = 0; i < ARRAY_SIZE(lq_sta->pers.chain_signal); i++) {
@@ -2530,7 +2525,7 @@ static void rs_get_rate(void *mvm_r, struct ieee80211_sta *sta, void *mvm_sta,
 static void *rs_alloc_sta(void *mvm_rate, struct ieee80211_sta *sta,
                           gfp_t gfp)
 {
-        struct iwl_mvm_sta *sta_priv = (struct iwl_mvm_sta *)sta->drv_priv;
+        struct iwl_mvm_sta *sta_priv = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_op_mode *op_mode = (struct iwl_op_mode *)mvm_rate;
         struct iwl_mvm *mvm  = IWL_OP_MODE_GET_MVM(op_mode);
         struct iwl_lq_sta *lq_sta = &sta_priv->lq_sta;
@@ -2606,68 +2601,121 @@ static void rs_vht_set_enabled_rates(struct ieee80211_sta *sta,
         }
 }
 
+static void rs_ht_init(struct iwl_mvm *mvm,
+                       struct ieee80211_sta *sta,
+                       struct iwl_lq_sta *lq_sta,
+                       struct ieee80211_sta_ht_cap *ht_cap)
+{
+        /* active_siso_rate mask includes 9 MBits (bit 5),
+         * and CCK (bits 0-3), supp_rates[] does not;
+         * shift to convert format, force 9 MBits off.
+         */
+        lq_sta->active_siso_rate = ht_cap->mcs.rx_mask[0] << 1;
+        lq_sta->active_siso_rate |= ht_cap->mcs.rx_mask[0] & 0x1;
+        lq_sta->active_siso_rate &= ~((u16)0x2);
+        lq_sta->active_siso_rate <<= IWL_FIRST_OFDM_RATE;
+
+        lq_sta->active_mimo2_rate = ht_cap->mcs.rx_mask[1] << 1;
+        lq_sta->active_mimo2_rate |= ht_cap->mcs.rx_mask[1] & 0x1;
+        lq_sta->active_mimo2_rate &= ~((u16)0x2);
+        lq_sta->active_mimo2_rate <<= IWL_FIRST_OFDM_RATE;
+
+        if (mvm->cfg->ht_params->ldpc &&
+            (ht_cap->cap & IEEE80211_HT_CAP_LDPC_CODING))
+                lq_sta->ldpc = true;
+
+        if (mvm->cfg->ht_params->stbc &&
+            (num_of_ant(iwl_mvm_get_valid_tx_ant(mvm)) > 1) &&
+            (ht_cap->cap & IEEE80211_HT_CAP_RX_STBC))
+                lq_sta->stbc_capable = true;
+
+        lq_sta->is_vht = false;
+}
+
+static void rs_vht_init(struct iwl_mvm *mvm,
+                        struct ieee80211_sta *sta,
+                        struct iwl_lq_sta *lq_sta,
+                        struct ieee80211_sta_vht_cap *vht_cap)
+{
+        rs_vht_set_enabled_rates(sta, vht_cap, lq_sta);
+
+        if (mvm->cfg->ht_params->ldpc &&
+            (vht_cap->cap & IEEE80211_VHT_CAP_RXLDPC))
+                lq_sta->ldpc = true;
+
+        if (mvm->cfg->ht_params->stbc &&
+            (num_of_ant(iwl_mvm_get_valid_tx_ant(mvm)) > 1) &&
+            (vht_cap->cap & IEEE80211_VHT_CAP_RXSTBC_MASK))
+                lq_sta->stbc_capable = true;
+
+        if ((mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_BEAMFORMER) &&
+            (num_of_ant(iwl_mvm_get_valid_tx_ant(mvm)) > 1) &&
+            (vht_cap->cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE))
+                lq_sta->bfer_capable = true;
+
+        lq_sta->is_vht = true;
+}
+
 #ifdef CONFIG_IWLWIFI_DEBUGFS
-static void iwl_mvm_reset_frame_stats(struct iwl_mvm *mvm,
-                                      struct iwl_mvm_frame_stats *stats)
+static void iwl_mvm_reset_frame_stats(struct iwl_mvm *mvm)
 {
         spin_lock_bh(&mvm->drv_stats_lock);
-        memset(stats, 0, sizeof(*stats));
+        memset(&mvm->drv_rx_stats, 0, sizeof(mvm->drv_rx_stats));
         spin_unlock_bh(&mvm->drv_stats_lock);
 }
 
-void iwl_mvm_update_frame_stats(struct iwl_mvm *mvm,
-                                struct iwl_mvm_frame_stats *stats,
-                                u32 rate, bool agg)
+void iwl_mvm_update_frame_stats(struct iwl_mvm *mvm, u32 rate, bool agg)
 {
         u8 nss = 0, mcs = 0;
 
         spin_lock(&mvm->drv_stats_lock);
 
         if (agg)
-                stats->agg_frames++;
+                mvm->drv_rx_stats.agg_frames++;
 
-        stats->success_frames++;
+        mvm->drv_rx_stats.success_frames++;
 
         switch (rate & RATE_MCS_CHAN_WIDTH_MSK) {
         case RATE_MCS_CHAN_WIDTH_20:
-                stats->bw_20_frames++;
+                mvm->drv_rx_stats.bw_20_frames++;
                 break;
         case RATE_MCS_CHAN_WIDTH_40:
-                stats->bw_40_frames++;
+                mvm->drv_rx_stats.bw_40_frames++;
                 break;
         case RATE_MCS_CHAN_WIDTH_80:
-                stats->bw_80_frames++;
+                mvm->drv_rx_stats.bw_80_frames++;
                 break;
         default:
                 WARN_ONCE(1, "bad BW. rate 0x%x", rate);
         }
 
         if (rate & RATE_MCS_HT_MSK) {
-                stats->ht_frames++;
+                mvm->drv_rx_stats.ht_frames++;
                 mcs = rate & RATE_HT_MCS_RATE_CODE_MSK;
                 nss = ((rate & RATE_HT_MCS_NSS_MSK) >> RATE_HT_MCS_NSS_POS) + 1;
         } else if (rate & RATE_MCS_VHT_MSK) {
-                stats->vht_frames++;
+                mvm->drv_rx_stats.vht_frames++;
                 mcs = rate & RATE_VHT_MCS_RATE_CODE_MSK;
                 nss = ((rate & RATE_VHT_MCS_NSS_MSK) >>
                        RATE_VHT_MCS_NSS_POS) + 1;
         } else {
-                stats->legacy_frames++;
+                mvm->drv_rx_stats.legacy_frames++;
         }
 
         if (nss == 1)
-                stats->siso_frames++;
+                mvm->drv_rx_stats.siso_frames++;
         else if (nss == 2)
-                stats->mimo2_frames++;
+                mvm->drv_rx_stats.mimo2_frames++;
 
         if (rate & RATE_MCS_SGI_MSK)
-                stats->sgi_frames++;
+                mvm->drv_rx_stats.sgi_frames++;
         else
-                stats->ngi_frames++;
+                mvm->drv_rx_stats.ngi_frames++;
 
-        stats->last_rates[stats->last_frame_idx] = rate;
-        stats->last_frame_idx = (stats->last_frame_idx + 1) %
-                ARRAY_SIZE(stats->last_rates);
+        mvm->drv_rx_stats.last_rates[mvm->drv_rx_stats.last_frame_idx] = rate;
+        mvm->drv_rx_stats.last_frame_idx =
+                (mvm->drv_rx_stats.last_frame_idx + 1) %
+                        ARRAY_SIZE(mvm->drv_rx_stats.last_rates);
 
         spin_unlock(&mvm->drv_stats_lock);
 }
@@ -2683,14 +2731,11 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         struct ieee80211_hw *hw = mvm->hw;
         struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
         struct ieee80211_sta_vht_cap *vht_cap = &sta->vht_cap;
-        struct iwl_mvm_sta *sta_priv;
-        struct iwl_lq_sta *lq_sta;
+        struct iwl_mvm_sta *sta_priv = iwl_mvm_sta_from_mac80211(sta);
+        struct iwl_lq_sta *lq_sta = &sta_priv->lq_sta;
         struct ieee80211_supported_band *sband;
         unsigned long supp; /* must be unsigned long for for_each_set_bit */
 
-        sta_priv = (struct iwl_mvm_sta *)sta->drv_priv;
-        lq_sta = &sta_priv->lq_sta;
-
         /* clear all non-persistent lq data */
         memset(lq_sta, 0, offsetof(typeof(*lq_sta), pers));
 
@@ -2712,7 +2757,7 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
          * previous packets? Need to have IEEE 802.1X auth succeed immediately
          * after assoc.. */
 
-        lq_sta->missed_rate_counter = IWL_MISSED_RATE_MAX;
+        lq_sta->missed_rate_counter = IWL_MVM_RS_MISSED_RATE_MAX;
         lq_sta->band = sband->band;
         /*
          * active legacy rates as per supported rates bitmap
@@ -2723,61 +2768,28 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                 lq_sta->active_legacy_rate |= BIT(sband->bitrates[i].hw_value);
 
         /* TODO: should probably account for rx_highest for both HT/VHT */
-        if (!vht_cap || !vht_cap->vht_supported) {
-                /* active_siso_rate mask includes 9 MBits (bit 5),
-                 * and CCK (bits 0-3), supp_rates[] does not;
-                 * shift to convert format, force 9 MBits off.
-                 */
-                lq_sta->active_siso_rate = ht_cap->mcs.rx_mask[0] << 1;
-                lq_sta->active_siso_rate |= ht_cap->mcs.rx_mask[0] & 0x1;
-                lq_sta->active_siso_rate &= ~((u16)0x2);
-                lq_sta->active_siso_rate <<= IWL_FIRST_OFDM_RATE;
-
-                /* Same here */
-                lq_sta->active_mimo2_rate = ht_cap->mcs.rx_mask[1] << 1;
-                lq_sta->active_mimo2_rate |= ht_cap->mcs.rx_mask[1] & 0x1;
-                lq_sta->active_mimo2_rate &= ~((u16)0x2);
-                lq_sta->active_mimo2_rate <<= IWL_FIRST_OFDM_RATE;
-
-                lq_sta->is_vht = false;
-                if (mvm->cfg->ht_params->ldpc &&
-                    (ht_cap->cap & IEEE80211_HT_CAP_LDPC_CODING))
-                        lq_sta->ldpc = true;
-
-                if (mvm->cfg->ht_params->stbc &&
-                    (num_of_ant(mvm->fw->valid_tx_ant) > 1) &&
-                    (ht_cap->cap & IEEE80211_HT_CAP_RX_STBC))
-                        lq_sta->stbc = true;
-        } else {
-                rs_vht_set_enabled_rates(sta, vht_cap, lq_sta);
-                lq_sta->is_vht = true;
-
-                if (mvm->cfg->ht_params->ldpc &&
-                    (vht_cap->cap & IEEE80211_VHT_CAP_RXLDPC))
-                        lq_sta->ldpc = true;
-
-                if (mvm->cfg->ht_params->stbc &&
-                    (num_of_ant(mvm->fw->valid_tx_ant) > 1) &&
-                    (vht_cap->cap & IEEE80211_VHT_CAP_RXSTBC_MASK))
-                        lq_sta->stbc = true;
-        }
+        if (!vht_cap || !vht_cap->vht_supported)
+                rs_ht_init(mvm, sta, lq_sta, ht_cap);
+        else
+                rs_vht_init(mvm, sta, lq_sta, vht_cap);
 
-        if (IWL_MVM_RS_DISABLE_MIMO)
+        if (IWL_MVM_RS_DISABLE_P2P_MIMO && sta_priv->vif->p2p)
                 lq_sta->active_mimo2_rate = 0;
 
-        lq_sta->max_legacy_rate_idx = find_last_bit(&lq_sta->active_legacy_rate,
-                                                    BITS_PER_LONG);
-        lq_sta->max_siso_rate_idx = find_last_bit(&lq_sta->active_siso_rate,
-                                                  BITS_PER_LONG);
-        lq_sta->max_mimo2_rate_idx = find_last_bit(&lq_sta->active_mimo2_rate,
-                                                   BITS_PER_LONG);
+        lq_sta->max_legacy_rate_idx =
+                rs_get_max_rate_from_mask(lq_sta->active_legacy_rate);
+        lq_sta->max_siso_rate_idx =
+                rs_get_max_rate_from_mask(lq_sta->active_siso_rate);
+        lq_sta->max_mimo2_rate_idx =
+                rs_get_max_rate_from_mask(lq_sta->active_mimo2_rate);
 
         IWL_DEBUG_RATE(mvm,
-                       "RATE MASK: LEGACY=%lX SISO=%lX MIMO2=%lX VHT=%d LDPC=%d STBC%d\n",
+                       "LEGACY=%lX SISO=%lX MIMO2=%lX VHT=%d LDPC=%d STBC=%d BFER=%d\n",
                        lq_sta->active_legacy_rate,
                        lq_sta->active_siso_rate,
                        lq_sta->active_mimo2_rate,
-                       lq_sta->is_vht, lq_sta->ldpc, lq_sta->stbc);
+                       lq_sta->is_vht, lq_sta->ldpc, lq_sta->stbc_capable,
+                       lq_sta->bfer_capable);
         IWL_DEBUG_RATE(mvm, "MAX RATE: LEGACY=%d SISO=%d MIMO2=%d\n",
                        lq_sta->max_legacy_rate_idx,
                        lq_sta->max_siso_rate_idx,
@@ -2785,14 +2797,14 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 
         /* These values will be overridden later */
         lq_sta->lq.single_stream_ant_msk =
-                first_antenna(mvm->fw->valid_tx_ant);
+                first_antenna(iwl_mvm_get_valid_tx_ant(mvm));
         lq_sta->lq.dual_stream_ant_msk = ANT_AB;
 
         /* as default allow aggregation for all tids */
         lq_sta->tx_agg_tid_en = IWL_AGG_ALL_TID;
         lq_sta->is_agg = 0;
 #ifdef CONFIG_IWLWIFI_DEBUGFS
-        iwl_mvm_reset_frame_stats(mvm, &mvm->drv_rx_stats);
+        iwl_mvm_reset_frame_stats(mvm);
 #endif
         rs_initialize_lq(mvm, sta, lq_sta, band, init);
 }
@@ -2861,12 +2873,13 @@ static void rs_fill_rates_for_column(struct iwl_mvm *mvm,
         int index = *rs_table_index;
 
         for (i = 0; i < num_rates && index < end; i++) {
-                ucode_rate = cpu_to_le32(ucode_rate_from_rs_rate(mvm, rate));
-                for (j = 0; j < num_retries && index < end; j++, index++)
+                for (j = 0; j < num_retries && index < end; j++, index++) {
+                        ucode_rate = cpu_to_le32(ucode_rate_from_rs_rate(mvm,
+                                                                         rate));
                         rs_table[index] = ucode_rate;
-
-                if (toggle_ant)
-                        rs_toggle_antenna(valid_tx_ant, rate);
+                        if (toggle_ant)
+                                rs_toggle_antenna(valid_tx_ant, rate);
+                }
 
                 prev_rate_idx = rate->index;
                 bottom_reached = rs_get_lower_rate_in_column(lq_sta, rate);
@@ -2874,7 +2887,7 @@ static void rs_fill_rates_for_column(struct iwl_mvm *mvm,
                         break;
         }
 
-        if (!bottom_reached)
+        if (!bottom_reached && !is_legacy(rate))
                 rate->index = prev_rate_idx;
 
         *rs_table_index = index;
@@ -2913,18 +2926,22 @@ static void rs_build_rates_table(struct iwl_mvm *mvm,
 
         memcpy(&rate, initial_rate, sizeof(rate));
 
-        valid_tx_ant = mvm->fw->valid_tx_ant;
-        rate.stbc = rs_stbc_allow(mvm, sta, lq_sta);
+        valid_tx_ant = iwl_mvm_get_valid_tx_ant(mvm);
+
+        /* TODO: remove old API when min FW API hits 14 */
+        if (!(mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_LQ_SS_PARAMS) &&
+            rs_stbc_allow(mvm, sta, lq_sta))
+                rate.stbc = true;
 
         if (is_siso(&rate)) {
-                num_rates = RS_INITIAL_SISO_NUM_RATES;
-                num_retries = RS_HT_VHT_RETRIES_PER_RATE;
+                num_rates = IWL_MVM_RS_INITIAL_SISO_NUM_RATES;
+                num_retries = IWL_MVM_RS_HT_VHT_RETRIES_PER_RATE;
         } else if (is_mimo(&rate)) {
-                num_rates = RS_INITIAL_MIMO_NUM_RATES;
-                num_retries = RS_HT_VHT_RETRIES_PER_RATE;
+                num_rates = IWL_MVM_RS_INITIAL_MIMO_NUM_RATES;
+                num_retries = IWL_MVM_RS_HT_VHT_RETRIES_PER_RATE;
         } else {
-                num_rates = RS_INITIAL_LEGACY_NUM_RATES;
-                num_retries = RS_LEGACY_RETRIES_PER_RATE;
+                num_rates = IWL_MVM_RS_INITIAL_LEGACY_NUM_RATES;
+                num_retries = IWL_MVM_RS_INITIAL_LEGACY_RETRIES;
                 toggle_ant = true;
         }
 
@@ -2935,12 +2952,12 @@ static void rs_build_rates_table(struct iwl_mvm *mvm,
         rs_get_lower_rate_down_column(lq_sta, &rate);
 
         if (is_siso(&rate)) {
-                num_rates = RS_SECONDARY_SISO_NUM_RATES;
-                num_retries = RS_SECONDARY_SISO_RETRIES;
+                num_rates = IWL_MVM_RS_SECONDARY_SISO_NUM_RATES;
+                num_retries = IWL_MVM_RS_SECONDARY_SISO_RETRIES;
                 lq_cmd->mimo_delim = index;
         } else if (is_legacy(&rate)) {
-                num_rates = RS_SECONDARY_LEGACY_NUM_RATES;
-                num_retries = RS_LEGACY_RETRIES_PER_RATE;
+                num_rates = IWL_MVM_RS_SECONDARY_LEGACY_NUM_RATES;
+                num_retries = IWL_MVM_RS_SECONDARY_LEGACY_RETRIES;
         } else {
                 WARN_ON_ONCE(1);
         }
@@ -2953,8 +2970,8 @@ static void rs_build_rates_table(struct iwl_mvm *mvm,
 
         rs_get_lower_rate_down_column(lq_sta, &rate);
 
-        num_rates = RS_SECONDARY_LEGACY_NUM_RATES;
-        num_retries = RS_LEGACY_RETRIES_PER_RATE;
+        num_rates = IWL_MVM_RS_SECONDARY_LEGACY_NUM_RATES;
+        num_retries = IWL_MVM_RS_SECONDARY_LEGACY_RETRIES;
 
         rs_fill_rates_for_column(mvm, lq_sta, &rate, lq_cmd->rs_table, &index,
                                  num_rates, num_retries, valid_tx_ant,
@@ -2962,6 +2979,142 @@ static void rs_build_rates_table(struct iwl_mvm *mvm,
 
 }
 
+struct rs_bfer_active_iter_data {
+        struct ieee80211_sta *exclude_sta;
+        struct iwl_mvm_sta *bfer_mvmsta;
+};
+
+static void rs_bfer_active_iter(void *_data,
+                                struct ieee80211_sta *sta)
+{
+        struct rs_bfer_active_iter_data *data = _data;
+        struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
+        struct iwl_lq_cmd *lq_cmd = &mvmsta->lq_sta.lq;
+        u32 ss_params = le32_to_cpu(lq_cmd->ss_params);
+
+        if (sta == data->exclude_sta)
+                return;
+
+        /* The current sta has BFER allowed */
+        if (ss_params & LQ_SS_BFER_ALLOWED) {
+                WARN_ON_ONCE(data->bfer_mvmsta != NULL);
+
+                data->bfer_mvmsta = mvmsta;
+        }
+}
+
+static int rs_bfer_priority(struct iwl_mvm_sta *sta)
+{
+        int prio = -1;
+        enum nl80211_iftype viftype = ieee80211_vif_type_p2p(sta->vif);
+
+        switch (viftype) {
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_P2P_GO:
+                prio = 3;
+                break;
+        case NL80211_IFTYPE_P2P_CLIENT:
+                prio = 2;
+                break;
+        case NL80211_IFTYPE_STATION:
+                prio = 1;
+                break;
+        default:
+                WARN_ONCE(true, "viftype %d sta_id %d", viftype, sta->sta_id);
+                prio = -1;
+        }
+
+        return prio;
+}
+
+/* Returns >0 if sta1 has a higher BFER priority compared to sta2 */
+static int rs_bfer_priority_cmp(struct iwl_mvm_sta *sta1,
+                                struct iwl_mvm_sta *sta2)
+{
+        int prio1 = rs_bfer_priority(sta1);
+        int prio2 = rs_bfer_priority(sta2);
+
+        if (prio1 > prio2)
+                return 1;
+        if (prio1 < prio2)
+                return -1;
+        return 0;
+}
+
+static void rs_set_lq_ss_params(struct iwl_mvm *mvm,
+                                struct ieee80211_sta *sta,
+                                struct iwl_lq_sta *lq_sta,
+                                const struct rs_rate *initial_rate)
+{
+        struct iwl_lq_cmd *lq_cmd = &lq_sta->lq;
+        struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
+        struct rs_bfer_active_iter_data data = {
+                .exclude_sta = sta,
+                .bfer_mvmsta = NULL,
+        };
+        struct iwl_mvm_sta *bfer_mvmsta = NULL;
+        u32 ss_params = LQ_SS_PARAMS_VALID;
+
+        if (!iwl_mvm_bt_coex_is_mimo_allowed(mvm, sta))
+                goto out;
+
+        /* Check if forcing the decision is configured.
+         * Note that SISO is forced by not allowing STBC or BFER
+         */
+        if (lq_sta->ss_force == RS_SS_FORCE_STBC)
+                ss_params |= (LQ_SS_STBC_1SS_ALLOWED | LQ_SS_FORCE);
+        else if (lq_sta->ss_force == RS_SS_FORCE_BFER)
+                ss_params |= (LQ_SS_BFER_ALLOWED | LQ_SS_FORCE);
+
+        if (lq_sta->ss_force != RS_SS_FORCE_NONE) {
+                IWL_DEBUG_RATE(mvm, "Forcing single stream Tx decision %d\n",
+                               lq_sta->ss_force);
+                goto out;
+        }
+
+        if (lq_sta->stbc_capable)
+                ss_params |= LQ_SS_STBC_1SS_ALLOWED;
+
+        if (!lq_sta->bfer_capable)
+                goto out;
+
+        ieee80211_iterate_stations_atomic(mvm->hw,
+                                          rs_bfer_active_iter,
+                                          &data);
+        bfer_mvmsta = data.bfer_mvmsta;
+
+        /* This code is safe as it doesn't run concurrently for different
+         * stations. This is guaranteed by the fact that calls to
+         * ieee80211_tx_status wouldn't run concurrently for a single HW.
+         */
+        if (!bfer_mvmsta) {
+                IWL_DEBUG_RATE(mvm, "No sta with BFER allowed found. Allow\n");
+
+                ss_params |= LQ_SS_BFER_ALLOWED;
+                goto out;
+        }
+
+        IWL_DEBUG_RATE(mvm, "Found existing sta %d with BFER activated\n",
+                       bfer_mvmsta->sta_id);
+
+        /* Disallow BFER on another STA if active and we're a higher priority */
+        if (rs_bfer_priority_cmp(mvmsta, bfer_mvmsta) > 0) {
+                struct iwl_lq_cmd *bfersta_lq_cmd = &bfer_mvmsta->lq_sta.lq;
+                u32 bfersta_ss_params = le32_to_cpu(bfersta_lq_cmd->ss_params);
+
+                bfersta_ss_params &= ~LQ_SS_BFER_ALLOWED;
+                bfersta_lq_cmd->ss_params = cpu_to_le32(bfersta_ss_params);
+                iwl_mvm_send_lq_cmd(mvm, bfersta_lq_cmd, false);
+
+                ss_params |= LQ_SS_BFER_ALLOWED;
+                IWL_DEBUG_RATE(mvm,
+                               "Lower priority BFER sta found (%d). Switch BFER\n",
+                               bfer_mvmsta->sta_id);
+        }
+out:
+        lq_cmd->ss_params = cpu_to_le32(ss_params);
+}
+
 static void rs_fill_lq_cmd(struct iwl_mvm *mvm,
                            struct ieee80211_sta *sta,
                            struct iwl_lq_sta *lq_sta,
@@ -2971,9 +3124,9 @@ static void rs_fill_lq_cmd(struct iwl_mvm *mvm,
         struct iwl_mvm_sta *mvmsta;
         struct iwl_mvm_vif *mvmvif;
 
-        lq_cmd->agg_disable_start_th = LINK_QUAL_AGG_DISABLE_START_DEF;
+        lq_cmd->agg_disable_start_th = IWL_MVM_RS_AGG_DISABLE_START;
         lq_cmd->agg_time_limit =
-                cpu_to_le16(LINK_QUAL_AGG_TIME_LIMIT_DEF);
+                cpu_to_le16(IWL_MVM_RS_AGG_TIME_LIMIT);
 
 #ifdef CONFIG_MAC80211_DEBUGFS
         if (lq_sta->pers.dbg_fixed_rate) {
@@ -2988,6 +3141,9 @@ static void rs_fill_lq_cmd(struct iwl_mvm *mvm,
 
         rs_build_rates_table(mvm, sta, lq_sta, initial_rate);
 
+        if (mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_LQ_SS_PARAMS)
+                rs_set_lq_ss_params(mvm, sta, lq_sta, initial_rate);
+
         if (num_of_ant(initial_rate->ant) == 1)
                 lq_cmd->single_stream_ant_msk = initial_rate->ant;
 
@@ -3167,9 +3323,9 @@ static ssize_t rs_sta_dbgfs_scale_table_read(struct file *file,
         desc += sprintf(buff+desc, "fixed rate 0x%X\n",
                         lq_sta->pers.dbg_fixed_rate);
         desc += sprintf(buff+desc, "valid_tx_ant %s%s%s\n",
-            (mvm->fw->valid_tx_ant & ANT_A) ? "ANT_A," : "",
-            (mvm->fw->valid_tx_ant & ANT_B) ? "ANT_B," : "",
-            (mvm->fw->valid_tx_ant & ANT_C) ? "ANT_C" : "");
+            (iwl_mvm_get_valid_tx_ant(mvm) & ANT_A) ? "ANT_A," : "",
+            (iwl_mvm_get_valid_tx_ant(mvm) & ANT_B) ? "ANT_B," : "",
+            (iwl_mvm_get_valid_tx_ant(mvm) & ANT_C) ? "ANT_C" : "");
         desc += sprintf(buff+desc, "lq type %s\n",
                         (is_legacy(rate)) ? "legacy" :
                         is_vht(rate) ? "VHT" : "HT");
@@ -3361,9 +3517,73 @@ static const struct file_operations rs_sta_dbgfs_drv_tx_stats_ops = {
         .llseek = default_llseek,
 };
 
+static ssize_t iwl_dbgfs_ss_force_read(struct file *file,
+                                       char __user *user_buf,
+                                       size_t count, loff_t *ppos)
+{
+        struct iwl_lq_sta *lq_sta = file->private_data;
+        char buf[12];
+        int bufsz = sizeof(buf);
+        int pos = 0;
+        static const char * const ss_force_name[] = {
+                [RS_SS_FORCE_NONE] = "none",
+                [RS_SS_FORCE_STBC] = "stbc",
+                [RS_SS_FORCE_BFER] = "bfer",
+                [RS_SS_FORCE_SISO] = "siso",
+        };
+
+        pos += scnprintf(buf+pos, bufsz-pos, "%s\n",
+                         ss_force_name[lq_sta->ss_force]);
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+}
+
+static ssize_t iwl_dbgfs_ss_force_write(struct iwl_lq_sta *lq_sta, char *buf,
+                                        size_t count, loff_t *ppos)
+{
+        struct iwl_mvm *mvm = lq_sta->pers.drv;
+        int ret = 0;
+
+        if (!strncmp("none", buf, 4)) {
+                lq_sta->ss_force = RS_SS_FORCE_NONE;
+        } else if (!strncmp("siso", buf, 4)) {
+                lq_sta->ss_force = RS_SS_FORCE_SISO;
+        } else if (!strncmp("stbc", buf, 4)) {
+                if (lq_sta->stbc_capable) {
+                        lq_sta->ss_force = RS_SS_FORCE_STBC;
+                } else {
+                        IWL_ERR(mvm,
+                                "can't force STBC. peer doesn't support\n");
+                        ret = -EINVAL;
+                }
+        } else if (!strncmp("bfer", buf, 4)) {
+                if (lq_sta->bfer_capable) {
+                        lq_sta->ss_force = RS_SS_FORCE_BFER;
+                } else {
+                        IWL_ERR(mvm,
+                                "can't force BFER. peer doesn't support\n");
+                        ret = -EINVAL;
+                }
+        } else {
+                IWL_ERR(mvm, "valid values none|siso|stbc|bfer\n");
+                ret = -EINVAL;
+        }
+        return ret ?: count;
+}
+
+#define MVM_DEBUGFS_READ_WRITE_FILE_OPS(name, bufsz) \
+        _MVM_DEBUGFS_READ_WRITE_FILE_OPS(name, bufsz, struct iwl_lq_sta)
+#define MVM_DEBUGFS_ADD_FILE_RS(name, parent, mode) do {                \
+                if (!debugfs_create_file(#name, mode, parent, lq_sta,   \
+                                         &iwl_dbgfs_##name##_ops))      \
+                        goto err;                                       \
+        } while (0)
+
+MVM_DEBUGFS_READ_WRITE_FILE_OPS(ss_force, 32);
+
 static void rs_add_debugfs(void *mvm, void *mvm_sta, struct dentry *dir)
 {
         struct iwl_lq_sta *lq_sta = mvm_sta;
+
         debugfs_create_file("rate_scale_table", S_IRUSR | S_IWUSR, dir,
                             lq_sta, &rs_sta_dbgfs_scale_table_ops);
         debugfs_create_file("rate_stats_table", S_IRUSR, dir,
@@ -3374,6 +3594,11 @@ static void rs_add_debugfs(void *mvm, void *mvm_sta, struct dentry *dir)
                           &lq_sta->tx_agg_tid_en);
         debugfs_create_u8("reduced_tpc", S_IRUSR | S_IWUSR, dir,
                           &lq_sta->pers.dbg_fixed_txp_reduction);
+
+        MVM_DEBUGFS_ADD_FILE_RS(ss_force, dir, S_IRUSR | S_IWUSR);
+        return;
+err:
+        IWL_ERR((struct iwl_mvm *)mvm, "Can't create debugfs entity\n");
 }
 
 static void rs_remove_debugfs(void *mvm, void *mvm_sta)
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.h b/drivers/net/wireless/iwlwifi/mvm/rs.h
index defd70a6d9e6..dc4ef3dfafe1 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.h
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.h
@@ -137,42 +137,10 @@ enum {
 
 #define IWL_INVALID_VALUE    -1
 
-#define IWL_MIN_RSSI_VAL                 -100
-#define IWL_MAX_RSSI_VAL                    0
-
-/* These values specify how many Tx frame attempts before
- * searching for a new modulation mode */
-#define IWL_LEGACY_FAILURE_LIMIT        160
-#define IWL_LEGACY_SUCCESS_LIMIT        480
-#define IWL_LEGACY_TABLE_COUNT          160
-
-#define IWL_NONE_LEGACY_FAILURE_LIMIT   400
-#define IWL_NONE_LEGACY_SUCCESS_LIMIT   4500
-#define IWL_NONE_LEGACY_TABLE_COUNT     1500
-
-/* Success ratio (ACKed / attempted tx frames) values (perfect is 128 * 100) */
-#define IWL_RS_GOOD_RATIO               12800   /* 100% */
-#define IWL_RATE_SCALE_SWITCH           10880   /*  85% */
-#define IWL_RATE_HIGH_TH                10880   /*  85% */
-#define IWL_RATE_INCREASE_TH            6400    /*  50% */
-#define RS_SR_FORCE_DECREASE            1920    /*  15% */
-#define RS_SR_NO_DECREASE               10880   /*  85% */
-
-#define TPC_SR_FORCE_INCREASE           9600    /* 75% */
-#define TPC_SR_NO_INCREASE              10880   /* 85% */
-#define TPC_TX_POWER_STEP               3
 #define TPC_MAX_REDUCTION               15
 #define TPC_NO_REDUCTION                0
 #define TPC_INVALID                     0xff
 
-#define LINK_QUAL_AGG_TIME_LIMIT_DEF    (4000) /* 4 milliseconds */
-#define LINK_QUAL_AGG_TIME_LIMIT_MAX    (8000)
-#define LINK_QUAL_AGG_TIME_LIMIT_MIN    (100)
-
-#define LINK_QUAL_AGG_DISABLE_START_DEF (3)
-#define LINK_QUAL_AGG_DISABLE_START_MAX (255)
-#define LINK_QUAL_AGG_DISABLE_START_MIN (0)
-
 #define LINK_QUAL_AGG_FRAME_LIMIT_DEF   (63)
 #define LINK_QUAL_AGG_FRAME_LIMIT_MAX   (63)
 #define LINK_QUAL_AGG_FRAME_LIMIT_MIN   (0)
@@ -181,14 +149,7 @@ enum {
 
 /* load per tid defines for A-MPDU activation */
 #define IWL_AGG_TPT_THREHOLD    0
-#define IWL_AGG_LOAD_THRESHOLD  10
 #define IWL_AGG_ALL_TID         0xff
-#define TID_QUEUE_CELL_SPACING  50      /*mS */
-#define TID_QUEUE_MAX_SIZE      20
-#define TID_ROUND_VALUE         5       /* mS */
-
-#define TID_MAX_TIME_DIFF ((TID_QUEUE_MAX_SIZE - 1) * TID_QUEUE_CELL_SPACING)
-#define TIME_WRAP_AROUND(x, y) (((y) > (x)) ? (y) - (x) : (0-(x)) + (y))
 
 enum iwl_table_type {
         LQ_NONE,
@@ -279,6 +240,13 @@ enum rs_column {
         RS_COLUMN_INVALID,
 };
 
+enum rs_ss_force_opt {
+        RS_SS_FORCE_NONE = 0,
+        RS_SS_FORCE_STBC,
+        RS_SS_FORCE_BFER,
+        RS_SS_FORCE_SISO,
+};
+
 /* Packet stats per rate */
 struct rs_rate_stats {
         u64 success;
@@ -332,7 +300,9 @@ struct iwl_lq_sta {
         u64 last_tx;
         bool is_vht;
         bool ldpc;              /* LDPC Rx is supported by the STA */
-        bool stbc;              /* Tx STBC is supported by chip and Rx by STA */
+        bool stbc_capable;      /* Tx STBC is supported by chip and Rx by STA */
+        bool bfer_capable;      /* Remote supports beamformee and we BFer */
+
         enum ieee80211_band band;
 
         /* The following are bitmaps of rates; IWL_RATE_6M_MASK, etc. */
@@ -361,6 +331,9 @@ struct iwl_lq_sta {
         /* tx power reduce for this sta */
         int tpc_reduce;
 
+        /* force STBC/BFER/SISO for testing */
+        enum rs_ss_force_opt ss_force;
+
         /* persistent fields - initialized only once - keep last! */
         struct lq_sta_pers {
 #ifdef CONFIG_MAC80211_DEBUGFS
diff --git a/drivers/net/wireless/iwlwifi/mvm/rx.c b/drivers/net/wireless/iwlwifi/mvm/rx.c
index 94b6e7297a1e..f922131b4eab 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rx.c
@@ -407,7 +407,7 @@ int iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
         }
 
 #ifdef CONFIG_IWLWIFI_DEBUGFS
-        iwl_mvm_update_frame_stats(mvm, &mvm->drv_rx_stats, rate_n_flags,
+        iwl_mvm_update_frame_stats(mvm, rate_n_flags,
                                    rx_status->flag & RX_FLAG_AMPDU_DETAILS);
 #endif
         iwl_mvm_pass_packet_to_mac80211(mvm, skb, hdr, len, ampdu_status,
@@ -511,13 +511,17 @@ int iwl_mvm_rx_statistics(struct iwl_mvm *mvm,
 {
         struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_notif_statistics *stats = (void *)&pkt->data;
-        struct mvm_statistics_general_common *common = &stats->general.common;
         struct iwl_mvm_stat_data data = {
                 .stats = stats,
                 .mvm = mvm,
         };
 
-        iwl_mvm_tt_temp_changed(mvm, le32_to_cpu(common->temperature));
+        /* Only handle rx statistics temperature changes if async temp
+         * notifications are not supported
+         */
+        if (!(mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_ASYNC_DTM))
+                iwl_mvm_tt_temp_changed(mvm,
+                                le32_to_cpu(stats->general.radio_temperature));
 
         iwl_mvm_update_rx_statistics(mvm, stats);
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index 844bf7c4c8de..7e9aa3cb3254 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -99,7 +99,7 @@ static u8 iwl_mvm_scan_rx_ant(struct iwl_mvm *mvm)
 {
         if (mvm->scan_rx_ant != ANT_NONE)
                 return mvm->scan_rx_ant;
-        return mvm->fw->valid_rx_ant;
+        return iwl_mvm_get_valid_rx_ant(mvm);
 }
 
 static inline __le16 iwl_mvm_scan_rx_chain(struct iwl_mvm *mvm)
@@ -130,7 +130,7 @@ iwl_mvm_scan_rate_n_flags(struct iwl_mvm *mvm, enum ieee80211_band band,
         u32 tx_ant;
 
         mvm->scan_last_antenna_idx =
-                iwl_mvm_next_antenna(mvm, mvm->fw->valid_tx_ant,
+                iwl_mvm_next_antenna(mvm, iwl_mvm_get_valid_tx_ant(mvm),
                                      mvm->scan_last_antenna_idx);
         tx_ant = BIT(mvm->scan_last_antenna_idx) << RATE_MCS_ANT_POS;
 
@@ -290,11 +290,11 @@ static void iwl_mvm_scan_condition_iterator(void *data, u8 *mac,
                                             struct ieee80211_vif *vif)
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        bool *global_bound = data;
+        int *global_cnt = data;
 
         if (vif->type != NL80211_IFTYPE_P2P_DEVICE && mvmvif->phy_ctxt &&
             mvmvif->phy_ctxt->id < MAX_PHYS)
-                *global_bound = true;
+                *global_cnt += 1;
 }
 
 static void iwl_mvm_scan_calc_params(struct iwl_mvm *mvm,
@@ -302,27 +302,31 @@ static void iwl_mvm_scan_calc_params(struct iwl_mvm *mvm,
                                      int n_ssids, u32 flags,
                                      struct iwl_mvm_scan_params *params)
 {
-        bool global_bound = false;
+        int global_cnt = 0;
         enum ieee80211_band band;
         u8 frag_passive_dwell = 0;
 
         ieee80211_iterate_active_interfaces_atomic(mvm->hw,
                                             IEEE80211_IFACE_ITER_NORMAL,
                                             iwl_mvm_scan_condition_iterator,
-                                            &global_bound);
+                                            &global_cnt);
 
-        if (!global_bound)
+        if (!global_cnt)
                 goto not_bound;
 
         params->suspend_time = 30;
-        params->max_out_time = 170;
+        params->max_out_time = 120;
 
         if (iwl_mvm_low_latency(mvm)) {
                 if (mvm->fw->ucode_capa.api[0] &
                     IWL_UCODE_TLV_API_FRAGMENTED_SCAN) {
                         params->suspend_time = 105;
-                        params->max_out_time = 70;
-                        frag_passive_dwell = 20;
+                        /*
+                         * If there is more than one active interface make
+                         * passive scan more fragmented.
+                         */
+                        frag_passive_dwell = (global_cnt < 2) ? 40 : 20;
+                        params->max_out_time = frag_passive_dwell;
                 } else {
                         params->suspend_time = 120;
                         params->max_out_time = 120;
@@ -539,6 +543,19 @@ int iwl_mvm_rx_scan_response(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
         return 0;
 }
 
+int iwl_mvm_rx_scan_offload_iter_complete_notif(struct iwl_mvm *mvm,
+                                                struct iwl_rx_cmd_buffer *rxb,
+                                                struct iwl_device_cmd *cmd)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        struct iwl_scan_complete_notif *notif = (void *)pkt->data;
+
+        IWL_DEBUG_SCAN(mvm,
+                       "Scan offload iteration complete: status=0x%x scanned channels=%d\n",
+                       notif->status, notif->scanned_channels);
+        return 0;
+}
+
 int iwl_mvm_rx_scan_complete(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
                           struct iwl_device_cmd *cmd)
 {
@@ -687,7 +704,8 @@ int iwl_mvm_rx_scan_offload_complete_notif(struct iwl_mvm *mvm,
                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
         }
 
-        mvm->last_ebs_successful = !ebs_status;
+        if (ebs_status)
+                mvm->last_ebs_successful = false;
 
         return 0;
 }
@@ -1480,6 +1498,11 @@ int iwl_mvm_unified_sched_scan_lmac(struct iwl_mvm *mvm,
         if (req->n_ssids == 0)
                 flags |= IWL_MVM_LMAC_SCAN_FLAG_PASSIVE;
 
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        if (mvm->scan_iter_notif_enabled)
+                flags |= IWL_MVM_LMAC_SCAN_FLAG_ITER_COMPLETE;
+#endif
+
         cmd->scan_flags |= cpu_to_le32(flags);
 
         cmd->flags = iwl_mvm_scan_rxon_flags(req->channels[0]->band);
@@ -1641,7 +1664,7 @@ int iwl_mvm_config_scan(struct iwl_mvm *mvm)
                                          SCAN_CONFIG_FLAG_SET_MAC_ADDR |
                                          SCAN_CONFIG_FLAG_SET_CHANNEL_FLAGS|
                                          SCAN_CONFIG_N_CHANNELS(num_channels));
-        scan_config->tx_chains = cpu_to_le32(mvm->fw->valid_tx_ant);
+        scan_config->tx_chains = cpu_to_le32(iwl_mvm_get_valid_tx_ant(mvm));
         scan_config->rx_chains = cpu_to_le32(iwl_mvm_scan_rx_ant(mvm));
         scan_config->legacy_rates = iwl_mvm_scan_config_rates(mvm);
         scan_config->out_of_channel_time = cpu_to_le32(170);
@@ -1660,10 +1683,10 @@ int iwl_mvm_config_scan(struct iwl_mvm *mvm)
 
         band = &mvm->nvm_data->bands[IEEE80211_BAND_2GHZ];
         for (i = 0; i < band->n_channels; i++, j++)
-                scan_config->channel_array[j] = band->channels[i].center_freq;
+                scan_config->channel_array[j] = band->channels[i].hw_value;
         band = &mvm->nvm_data->bands[IEEE80211_BAND_5GHZ];
         for (i = 0; i < band->n_channels; i++, j++)
-                scan_config->channel_array[j] = band->channels[i].center_freq;
+                scan_config->channel_array[j] = band->channels[i].hw_value;
 
         cmd.data[0] = scan_config;
         cmd.len[0] = cmd_size;
@@ -1840,6 +1863,13 @@ int iwl_mvm_scan_umac(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         flags |= IWL_UMAC_SCAN_GEN_FLAGS_PASS_ALL;
 
         cmd->general_flags = cpu_to_le32(flags);
+
+        if (mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_SINGLE_SCAN_EBS &&
+            mvm->last_ebs_successful)
+                cmd->channel_flags = IWL_SCAN_CHANNEL_FLAG_EBS |
+                                     IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
+                                     IWL_SCAN_CHANNEL_FLAG_CACHE_ADD;
+
         cmd->n_channels = req->req.n_channels;
 
         for (i = 0; i < req->req.n_ssids; i++)
@@ -2003,7 +2033,9 @@ int iwl_mvm_rx_umac_scan_complete_notif(struct iwl_mvm *mvm,
                        notif->ebs_status == IWL_SCAN_EBS_SUCCESS ?
                                 "success" : "failed");
 
-        mvm->last_ebs_successful = !notif->ebs_status;
+        if (notif->ebs_status)
+                mvm->last_ebs_successful = false;
+
         mvm->scan_uid[uid_idx] = 0;
 
         if (!sched) {
@@ -2036,10 +2068,14 @@ static bool iwl_scan_umac_done_check(struct iwl_notif_wait_data *notif_wait,
 
         /*
          * Clear scan uid of scans that was aborted from above and completed
-         * in FW so the RX handler does nothing.
+         * in FW so the RX handler does nothing. Set last_ebs_successful here if
+         * needed.
          */
         scan_done->mvm->scan_uid[uid_idx] = 0;
 
+        if (notif->ebs_status)
+                scan_done->mvm->last_ebs_successful = false;
+
         return !iwl_mvm_find_scan_type(scan_done->mvm, scan_done->type);
 }
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
index d86fe432e51f..5c23cddaaae3 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
@@ -99,7 +99,7 @@ static int iwl_mvm_find_free_sta_id(struct iwl_mvm *mvm,
 int iwl_mvm_sta_send_to_fw(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                            bool update)
 {
-        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_mvm_add_sta_cmd add_sta_cmd = {
                 .sta_id = mvm_sta->sta_id,
                 .mac_id_n_color = cpu_to_le32(mvm_sta->mac_id_n_color),
@@ -209,6 +209,9 @@ static int iwl_mvm_tdls_sta_init(struct iwl_mvm *mvm,
 {
         unsigned long used_hw_queues;
         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
+        unsigned int wdg_timeout = iwlmvm_mod_params.tfd_q_hang_detect ?
+                                        mvm->cfg->base_params->wd_timeout :
+                                        IWL_WATCHDOG_DISABLED;
         u32 ac;
 
         lockdep_assert_held(&mvm->mutex);
@@ -232,7 +235,7 @@ static int iwl_mvm_tdls_sta_init(struct iwl_mvm *mvm,
         /* Found a place for all queues - enable them */
         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
                 iwl_mvm_enable_ac_txq(mvm, mvmsta->hw_queue[ac],
-                                      iwl_mvm_ac_to_tx_fifo[ac]);
+                                      iwl_mvm_ac_to_tx_fifo[ac], wdg_timeout);
                 mvmsta->tfd_queue_msk |= BIT(mvmsta->hw_queue[ac]);
         }
 
@@ -250,8 +253,8 @@ static void iwl_mvm_tdls_sta_deinit(struct iwl_mvm *mvm,
 
         /* disable the TDLS STA-specific queues */
         sta_msk = mvmsta->tfd_queue_msk;
-        for_each_set_bit(i, &sta_msk, sizeof(sta_msk))
-                iwl_mvm_disable_txq(mvm, i);
+        for_each_set_bit(i, &sta_msk, sizeof(sta_msk) * BITS_PER_BYTE)
+                iwl_mvm_disable_txq(mvm, i, 0);
 }
 
 int iwl_mvm_add_sta(struct iwl_mvm *mvm,
@@ -259,7 +262,7 @@ int iwl_mvm_add_sta(struct iwl_mvm *mvm,
                     struct ieee80211_sta *sta)
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
         int i, ret, sta_id;
 
         lockdep_assert_held(&mvm->mutex);
@@ -464,8 +467,8 @@ void iwl_mvm_sta_drained_wk(struct work_struct *wk)
                 if (mvm->tfd_drained[sta_id]) {
                         unsigned long i, msk = mvm->tfd_drained[sta_id];
 
-                        for_each_set_bit(i, &msk, sizeof(msk))
-                                iwl_mvm_disable_txq(mvm, i);
+                        for_each_set_bit(i, &msk, sizeof(msk) * BITS_PER_BYTE)
+                                iwl_mvm_disable_txq(mvm, i, 0);
 
                         mvm->tfd_drained[sta_id] = 0;
                         IWL_DEBUG_TDLS(mvm, "Drained sta %d, with queues %ld\n",
@@ -481,7 +484,7 @@ int iwl_mvm_rm_sta(struct iwl_mvm *mvm,
                    struct ieee80211_sta *sta)
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
         int ret;
 
         lockdep_assert_held(&mvm->mutex);
@@ -626,13 +629,16 @@ static int iwl_mvm_add_int_sta_common(struct iwl_mvm *mvm,
 
 int iwl_mvm_add_aux_sta(struct iwl_mvm *mvm)
 {
+        unsigned int wdg_timeout = iwlmvm_mod_params.tfd_q_hang_detect ?
+                                        mvm->cfg->base_params->wd_timeout :
+                                        IWL_WATCHDOG_DISABLED;
         int ret;
 
         lockdep_assert_held(&mvm->mutex);
 
         /* Map Aux queue to fifo - needs to happen before adding Aux station */
         iwl_mvm_enable_ac_txq(mvm, mvm->aux_queue,
-                              IWL_MVM_TX_FIFO_MCAST);
+                              IWL_MVM_TX_FIFO_MCAST, wdg_timeout);
 
         /* Allocate aux station and assign to it the aux queue */
         ret = iwl_mvm_allocate_int_sta(mvm, &mvm->aux_sta, BIT(mvm->aux_queue),
@@ -774,7 +780,7 @@ int iwl_mvm_rm_bcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                        int tid, u16 ssn, bool start)
 {
-        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_mvm_add_sta_cmd cmd = {};
         int ret;
         u32 status;
@@ -834,7 +840,7 @@ int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 static int iwl_mvm_sta_tx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                               int tid, u8 queue, bool start)
 {
-        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_mvm_add_sta_cmd cmd = {};
         int ret;
         u32 status;
@@ -965,6 +971,9 @@ int iwl_mvm_sta_tx_agg_oper(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 {
         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
+        unsigned int wdg_timeout = iwlmvm_mod_params.tfd_q_hang_detect ?
+                                        mvm->cfg->base_params->wd_timeout :
+                                        IWL_WATCHDOG_DISABLED;
         int queue, fifo, ret;
         u16 ssn;
 
@@ -988,7 +997,7 @@ int iwl_mvm_sta_tx_agg_oper(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                 return -EIO;
 
         iwl_mvm_enable_agg_txq(mvm, queue, fifo, mvmsta->sta_id, tid,
-                               buf_size, ssn);
+                               buf_size, ssn, wdg_timeout);
 
         /*
          * Even though in theory the peer could have different
@@ -1058,7 +1067,7 @@ int iwl_mvm_sta_tx_agg_stop(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 
                 iwl_mvm_sta_tx_agg(mvm, sta, tid, txq_id, false);
 
-                iwl_mvm_disable_txq(mvm, txq_id);
+                iwl_mvm_disable_txq(mvm, txq_id, 0);
                 return 0;
         case IWL_AGG_STARTING:
         case IWL_EMPTYING_HW_QUEUE_ADDBA:
@@ -1116,7 +1125,7 @@ int iwl_mvm_sta_tx_agg_flush(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 
                 iwl_mvm_sta_tx_agg(mvm, sta, tid, txq_id, false);
 
-                iwl_mvm_disable_txq(mvm, tid_data->txq_id);
+                iwl_mvm_disable_txq(mvm, tid_data->txq_id, 0);
         }
 
         mvm->queue_to_mac80211[tid_data->txq_id] =
@@ -1144,10 +1153,10 @@ static int iwl_mvm_set_fw_key_idx(struct iwl_mvm *mvm)
 static u8 iwl_mvm_get_key_sta_id(struct ieee80211_vif *vif,
                                  struct ieee80211_sta *sta)
 {
-        struct iwl_mvm_vif *mvmvif = (void *)vif->drv_priv;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 
         if (sta) {
-                struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+                struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
 
                 return mvm_sta->sta_id;
         }
@@ -1196,6 +1205,7 @@ static int iwl_mvm_send_sta_key(struct iwl_mvm *mvm,
                 break;
         case WLAN_CIPHER_SUITE_WEP104:
                 key_flags |= cpu_to_le16(STA_KEY_FLG_WEP_13BYTES);
+                /* fall through */
         case WLAN_CIPHER_SUITE_WEP40:
                 key_flags |= cpu_to_le16(STA_KEY_FLG_WEP);
                 memcpy(cmd.key + 3, keyconf->key, keyconf->keylen);
@@ -1280,7 +1290,7 @@ static inline u8 *iwl_mvm_get_mac_addr(struct iwl_mvm *mvm,
                                        struct ieee80211_vif *vif,
                                        struct ieee80211_sta *sta)
 {
-        struct iwl_mvm_vif *mvmvif = (void *)vif->drv_priv;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 
         if (sta)
                 return sta->addr;
diff --git a/drivers/net/wireless/iwlwifi/mvm/tdls.c b/drivers/net/wireless/iwlwifi/mvm/tdls.c
index c0e00bae5bd0..a87b506c8c72 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tdls.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tdls.c
@@ -64,6 +64,8 @@
 #include <linux/etherdevice.h>
 #include "mvm.h"
 #include "time-event.h"
+#include "iwl-io.h"
+#include "iwl-prph.h"
 
 #define TU_TO_US(x) (x * 1024)
 #define TU_TO_MS(x) (TU_TO_US(x) / 1000)
@@ -228,6 +230,8 @@ iwl_mvm_tdls_cs_state_str(enum iwl_mvm_tdls_cs_state state)
                 return "IDLE";
         case IWL_MVM_TDLS_SW_REQ_SENT:
                 return "REQ SENT";
+        case IWL_MVM_TDLS_SW_RESP_RCVD:
+                return "RESP RECEIVED";
         case IWL_MVM_TDLS_SW_REQ_RCVD:
                 return "REQ RECEIVED";
         case IWL_MVM_TDLS_SW_ACTIVE:
@@ -248,6 +252,11 @@ static void iwl_mvm_tdls_update_cs_state(struct iwl_mvm *mvm,
                        iwl_mvm_tdls_cs_state_str(state));
         mvm->tdls_cs.state = state;
 
+        /* we only send requests to our switching peer - update sent time */
+        if (state == IWL_MVM_TDLS_SW_REQ_SENT)
+                mvm->tdls_cs.peer.sent_timestamp =
+                        iwl_read_prph(mvm->trans, DEVICE_SYSTEM_TIME_REG);
+
         if (state == IWL_MVM_TDLS_SW_IDLE)
                 mvm->tdls_cs.cur_sta_id = IWL_MVM_STATION_COUNT;
 }
@@ -300,7 +309,7 @@ out:
 static int
 iwl_mvm_tdls_check_action(struct iwl_mvm *mvm,
                           enum iwl_tdls_channel_switch_type type,
-                          const u8 *peer, bool peer_initiator)
+                          const u8 *peer, bool peer_initiator, u32 timestamp)
 {
         bool same_peer = false;
         int ret = 0;
@@ -325,17 +334,30 @@ iwl_mvm_tdls_check_action(struct iwl_mvm *mvm,
                         ret = -EINVAL;
                 break;
         case IWL_MVM_TDLS_SW_REQ_SENT:
+                /* only allow requests from the same peer */
+                if (!same_peer)
+                        ret = -EBUSY;
+                else if (type == TDLS_SEND_CHAN_SW_RESP_AND_MOVE_CH &&
+                         !peer_initiator)
+                        /*
+                         * We received a ch-switch request while an outgoing
+                         * one is pending. Allow it if the peer is the link
+                         * initiator.
+                         */
+                        ret = -EBUSY;
+                else if (type == TDLS_SEND_CHAN_SW_REQ)
+                        /* wait for idle before sending another request */
+                        ret = -EBUSY;
+                else if (timestamp <= mvm->tdls_cs.peer.sent_timestamp)
+                        /* we got a stale response - ignore it */
+                        ret = -EINVAL;
+                break;
+        case IWL_MVM_TDLS_SW_RESP_RCVD:
                 /*
-                 * We received a ch-switch request while an outgoing one is
-                 * pending. Allow it to proceed if the other peer is the same
-                 * one we sent to, and we are not the link initiator.
+                 * we are waiting for the FW to give an "active" notification,
+                 * so ignore requests in the meantime
                  */
-                if (type == TDLS_SEND_CHAN_SW_RESP_AND_MOVE_CH) {
-                        if (!same_peer)
-                                ret = -EBUSY;
-                        else if (!peer_initiator) /* we are the initiator */
-                                ret = -EBUSY;
-                }
+                ret = -EBUSY;
                 break;
         case IWL_MVM_TDLS_SW_REQ_RCVD:
                 /* as above, allow the link initiator to proceed */
@@ -349,9 +371,12 @@ iwl_mvm_tdls_check_action(struct iwl_mvm *mvm,
                 }
                 break;
         case IWL_MVM_TDLS_SW_ACTIVE:
-                /* we don't allow initiations during active channel switch */
-                if (type == TDLS_SEND_CHAN_SW_REQ)
-                        ret = -EINVAL;
+                /*
+                 * the only valid request when active is a request to return
+                 * to the base channel by the current off-channel peer
+                 */
+                if (type != TDLS_MOVE_CH || !same_peer)
+                        ret = -EBUSY;
                 break;
         }
 
@@ -384,7 +409,8 @@ iwl_mvm_tdls_config_channel_switch(struct iwl_mvm *mvm,
 
         lockdep_assert_held(&mvm->mutex);
 
-        ret = iwl_mvm_tdls_check_action(mvm, type, peer, peer_initiator);
+        ret = iwl_mvm_tdls_check_action(mvm, type, peer, peer_initiator,
+                                        timestamp);
         if (ret)
                 return ret;
 
@@ -473,6 +499,8 @@ iwl_mvm_tdls_config_channel_switch(struct iwl_mvm *mvm,
                                              type == TDLS_SEND_CHAN_SW_REQ ?
                                              IWL_MVM_TDLS_SW_REQ_SENT :
                                              IWL_MVM_TDLS_SW_REQ_RCVD);
+        } else {
+                iwl_mvm_tdls_update_cs_state(mvm, IWL_MVM_TDLS_SW_RESP_RCVD);
         }
 
 out:
@@ -657,12 +685,15 @@ iwl_mvm_tdls_recv_channel_switch(struct ieee80211_hw *hw,
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
         enum iwl_tdls_channel_switch_type type;
         unsigned int delay;
+        const char *action_str =
+                params->action_code == WLAN_TDLS_CHANNEL_SWITCH_REQUEST ?
+                "REQ" : "RESP";
 
         mutex_lock(&mvm->mutex);
 
         IWL_DEBUG_TDLS(mvm,
-                       "Received TDLS ch switch action %d from %pM status %d\n",
-                       params->action_code, params->sta->addr, params->status);
+                       "Received TDLS ch switch action %s from %pM status %d\n",
+                       action_str, params->sta->addr, params->status);
 
         /*
          * we got a non-zero status from a peer we were switching to - move to
diff --git a/drivers/net/wireless/iwlwifi/mvm/tt.c b/drivers/net/wireless/iwlwifi/mvm/tt.c
index 2b1e61fac34a..ba615ad2176c 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tt.c
@@ -69,6 +69,7 @@
 
 static void iwl_mvm_enter_ctkill(struct iwl_mvm *mvm)
 {
+        struct iwl_mvm_tt_mgmt *tt = &mvm->thermal_throttle;
         u32 duration = mvm->thermal_throttle.params->ct_kill_duration;
 
         if (test_bit(IWL_MVM_STATUS_HW_CTKILL, &mvm->status))
@@ -77,12 +78,15 @@ static void iwl_mvm_enter_ctkill(struct iwl_mvm *mvm)
         IWL_ERR(mvm, "Enter CT Kill\n");
         iwl_mvm_set_hw_ctkill_state(mvm, true);
 
+        tt->throttle = false;
+        tt->dynamic_smps = false;
+
         /* Don't schedule an exit work if we're in test mode, since
          * the temperature will not change unless we manually set it
          * again (or disable testing).
          */
         if (!mvm->temperature_test)
-                schedule_delayed_work(&mvm->thermal_throttle.ct_kill_exit,
+                schedule_delayed_work(&tt->ct_kill_exit,
                                       round_jiffies_relative(duration * HZ));
 }
 
@@ -452,6 +456,7 @@ void iwl_mvm_tt_initialize(struct iwl_mvm *mvm, u32 min_backoff)
                 tt->params = &iwl7000_tt_params;
 
         tt->throttle = false;
+        tt->dynamic_smps = false;
         tt->min_backoff = min_backoff;
         INIT_DELAYED_WORK(&tt->ct_kill_exit, check_exit_ctkill);
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index c59d07567d90..07304e1fd64a 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -220,7 +220,7 @@ void iwl_mvm_set_tx_cmd_rate(struct iwl_mvm *mvm, struct iwl_tx_cmd *tx_cmd,
         rate_plcp = iwl_mvm_mac80211_idx_to_hwrate(rate_idx);
 
         mvm->mgmt_last_antenna_idx =
-                iwl_mvm_next_antenna(mvm, mvm->fw->valid_tx_ant,
+                iwl_mvm_next_antenna(mvm, iwl_mvm_get_valid_tx_ant(mvm),
                                      mvm->mgmt_last_antenna_idx);
 
         if (info->band == IEEE80211_BAND_2GHZ &&
@@ -507,7 +507,7 @@ static void iwl_mvm_check_ratid_empty(struct iwl_mvm *mvm,
                 IWL_DEBUG_TX_QUEUES(mvm,
                                     "Can continue DELBA flow ssn = next_recl = %d\n",
                                     tid_data->next_reclaimed);
-                iwl_mvm_disable_txq(mvm, tid_data->txq_id);
+                iwl_mvm_disable_txq(mvm, tid_data->txq_id, CMD_ASYNC);
                 tid_data->state = IWL_AGG_OFF;
                 /*
                  * we can't hold the mutex - but since we are after a sequence
@@ -667,7 +667,8 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
 
                 /* Single frame failure in an AMPDU queue => send BAR */
                 if (txq_id >= mvm->first_agg_queue &&
-                    !(info->flags & IEEE80211_TX_STAT_ACK))
+                    !(info->flags & IEEE80211_TX_STAT_ACK) &&
+                    !(info->flags & IEEE80211_TX_STAT_TX_FILTERED))
                         info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;
 
                 /* W/A FW bug: seq_ctl is wrong when the status isn't success */
@@ -930,6 +931,11 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
         sta_id = ba_notif->sta_id;
         tid = ba_notif->tid;
 
+        if (WARN_ONCE(sta_id >= IWL_MVM_STATION_COUNT ||
+                      tid >= IWL_MAX_TID_COUNT,
+                      "sta_id %d tid %d", sta_id, tid))
+                return 0;
+
         rcu_read_lock();
 
         sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
diff --git a/drivers/net/wireless/iwlwifi/mvm/utils.c b/drivers/net/wireless/iwlwifi/mvm/utils.c
index 917431e30f74..8decf9953229 100644
--- a/drivers/net/wireless/iwlwifi/mvm/utils.c
+++ b/drivers/net/wireless/iwlwifi/mvm/utils.c
@@ -432,7 +432,7 @@ static void iwl_mvm_dump_umac_error_log(struct iwl_mvm *mvm)
                         mvm->status, table.valid);
         }
 
-        IWL_ERR(mvm, "0x%08X | %-28s\n", table.error_id,
+        IWL_ERR(mvm, "0x%08X | %s\n", table.error_id,
                 desc_lookup(table.error_id));
         IWL_ERR(mvm, "0x%08X | umac branchlink1\n", table.blink1);
         IWL_ERR(mvm, "0x%08X | umac branchlink2\n", table.blink2);
@@ -531,49 +531,50 @@ void iwl_mvm_dump_nic_error_log(struct iwl_mvm *mvm)
 }
 
 void iwl_mvm_enable_txq(struct iwl_mvm *mvm, int queue, u16 ssn,
-                        const struct iwl_trans_txq_scd_cfg *cfg)
+                        const struct iwl_trans_txq_scd_cfg *cfg,
+                        unsigned int wdg_timeout)
 {
-        if (iwl_mvm_is_dqa_supported(mvm)) {
-                struct iwl_scd_txq_cfg_cmd cmd = {
-                        .scd_queue = queue,
-                        .enable = 1,
-                        .window = cfg->frame_limit,
-                        .sta_id = cfg->sta_id,
-                        .ssn = cpu_to_le16(ssn),
-                        .tx_fifo = cfg->fifo,
-                        .aggregate = cfg->aggregate,
-                        .flags = IWL_SCD_FLAGS_DQA_ENABLED,
-                        .tid = cfg->tid,
-                        .control = IWL_SCD_CONTROL_SET_SSN,
-                };
-                int ret = iwl_mvm_send_cmd_pdu(mvm, SCD_QUEUE_CFG, 0,
-                                               sizeof(cmd), &cmd);
-                if (ret)
-                        IWL_ERR(mvm,
-                                "Failed to configure queue %d on FIFO %d\n",
-                                queue, cfg->fifo);
+        struct iwl_scd_txq_cfg_cmd cmd = {
+                .scd_queue = queue,
+                .enable = 1,
+                .window = cfg->frame_limit,
+                .sta_id = cfg->sta_id,
+                .ssn = cpu_to_le16(ssn),
+                .tx_fifo = cfg->fifo,
+                .aggregate = cfg->aggregate,
+                .tid = cfg->tid,
+        };
+
+        if (!iwl_mvm_is_scd_cfg_supported(mvm)) {
+                iwl_trans_txq_enable_cfg(mvm->trans, queue, ssn, cfg,
+                                         wdg_timeout);
+                return;
         }
 
-        iwl_trans_txq_enable_cfg(mvm->trans, queue, ssn,
-                                 iwl_mvm_is_dqa_supported(mvm) ? NULL : cfg);
+        iwl_trans_txq_enable_cfg(mvm->trans, queue, ssn, NULL, wdg_timeout);
+        WARN(iwl_mvm_send_cmd_pdu(mvm, SCD_QUEUE_CFG, 0, sizeof(cmd), &cmd),
+             "Failed to configure queue %d on FIFO %d\n", queue, cfg->fifo);
 }
 
-void iwl_mvm_disable_txq(struct iwl_mvm *mvm, int queue)
+void iwl_mvm_disable_txq(struct iwl_mvm *mvm, int queue, u8 flags)
 {
-        iwl_trans_txq_disable(mvm->trans, queue,
-                              !iwl_mvm_is_dqa_supported(mvm));
-
-        if (iwl_mvm_is_dqa_supported(mvm)) {
-                struct iwl_scd_txq_cfg_cmd cmd = {
-                        .scd_queue = queue,
-                        .enable = 0,
-                };
-                int ret = iwl_mvm_send_cmd_pdu(mvm, SCD_QUEUE_CFG, CMD_ASYNC,
-                                               sizeof(cmd), &cmd);
-                if (ret)
-                        IWL_ERR(mvm, "Failed to disable queue %d (ret=%d)\n",
-                                queue, ret);
+        struct iwl_scd_txq_cfg_cmd cmd = {
+                .scd_queue = queue,
+                .enable = 0,
+        };
+        int ret;
+
+        if (!iwl_mvm_is_scd_cfg_supported(mvm)) {
+                iwl_trans_txq_disable(mvm->trans, queue, true);
+                return;
         }
+
+        iwl_trans_txq_disable(mvm->trans, queue, false);
+        ret = iwl_mvm_send_cmd_pdu(mvm, SCD_QUEUE_CFG, flags,
+                                   sizeof(cmd), &cmd);
+        if (ret)
+                IWL_ERR(mvm, "Failed to disable queue %d (ret=%d)\n",
+                        queue, ret);
 }
 
 /**
@@ -620,7 +621,7 @@ void iwl_mvm_update_smps(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         lockdep_assert_held(&mvm->mutex);
 
         /* SMPS is irrelevant for NICs that don't have at least 2 RX antenna */
-        if (num_of_ant(mvm->fw->valid_rx_ant) == 1)
+        if (num_of_ant(iwl_mvm_get_valid_rx_ant(mvm)) == 1)
                 return;
 
         if (vif->type == NL80211_IFTYPE_AP)
@@ -662,7 +663,7 @@ bool iwl_mvm_rx_diversity_allowed(struct iwl_mvm *mvm)
 
         lockdep_assert_held(&mvm->mutex);
 
-        if (num_of_ant(mvm->fw->valid_rx_ant) == 1)
+        if (num_of_ant(iwl_mvm_get_valid_rx_ant(mvm)) == 1)
                 return false;
 
         if (mvm->cfg->rx_with_siso_diversity)
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index d5aadb00dd9e..dbd6bcf52205 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -415,6 +415,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x24F3, 0x0010, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F3, 0x0004, iwl8260_2n_cfg)},
         {IWL_PCI_DEVICE(0x24F4, 0x0030, iwl8260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x24F5, 0x0010, iwl4165_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x24F6, 0x0030, iwl4165_2ac_cfg)},
 #endif /* CONFIG_IWLMVM */
 
         {0}
diff --git a/drivers/net/wireless/iwlwifi/pcie/internal.h b/drivers/net/wireless/iwlwifi/pcie/internal.h
index 1aea6b66c594..cae0eb8835ce 100644
--- a/drivers/net/wireless/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/iwlwifi/pcie/internal.h
@@ -216,6 +216,7 @@ struct iwl_pcie_txq_scratch_buf {
  * @need_update: indicates need to update read/write index
  * @active: stores if queue is active
  * @ampdu: true if this queue is an ampdu queue for an specific RA/TID
+ * @wd_timeout: queue watchdog timeout (jiffies) - per queue
  *
  * A Tx queue consists of circular buffer of BDs (a.k.a. TFDs, transmit frame
  * descriptors) and required locking structures.
@@ -232,6 +233,7 @@ struct iwl_txq {
         bool need_update;
         u8 active;
         bool ampdu;
+        unsigned long wd_timeout;
 };
 
 static inline dma_addr_t
@@ -259,7 +261,6 @@ iwl_pcie_get_scratchbuf_dma(struct iwl_txq *txq, int idx)
  * @bc_table_dword: true if the BC table expects DWORD (as opposed to bytes)
  * @scd_set_active: should the transport configure the SCD for HCMD queue
  * @rx_page_order: page order for receive buffer size
- * @wd_timeout: queue watchdog timeout (jiffies)
  * @reg_lock: protect hw register access
  * @cmd_in_flight: true when we have a host command in flight
  * @fw_mon_phys: physical address of the buffer for the firmware monitor
@@ -302,6 +303,7 @@ struct iwl_trans_pcie {
 
         u8 cmd_queue;
         u8 cmd_fifo;
+        unsigned int cmd_q_wdg_timeout;
         u8 n_no_reclaim_cmds;
         u8 no_reclaim_cmds[MAX_NO_RECLAIM_CMDS];
 
@@ -312,12 +314,14 @@ struct iwl_trans_pcie {
 
         const char *const *command_names;
 
-        /* queue watchdog */
-        unsigned long wd_timeout;
-
         /*protect hw register */
         spinlock_t reg_lock;
         bool cmd_in_flight;
+        bool ref_cmd_in_flight;
+
+        /* protect ref counter */
+        spinlock_t ref_lock;
+        u32 ref_count;
 
         dma_addr_t fw_mon_phys;
         struct page *fw_mon_page;
@@ -368,7 +372,8 @@ void iwl_pcie_tx_start(struct iwl_trans *trans, u32 scd_base_addr);
 int iwl_pcie_tx_stop(struct iwl_trans *trans);
 void iwl_pcie_tx_free(struct iwl_trans *trans);
 void iwl_trans_pcie_txq_enable(struct iwl_trans *trans, int queue, u16 ssn,
-                               const struct iwl_trans_txq_scd_cfg *cfg);
+                               const struct iwl_trans_txq_scd_cfg *cfg,
+                               unsigned int wdg_timeout);
 void iwl_trans_pcie_txq_disable(struct iwl_trans *trans, int queue,
                                 bool configure_scd);
 int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
@@ -381,6 +386,9 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
                             struct sk_buff_head *skbs);
 void iwl_trans_pcie_tx_reset(struct iwl_trans *trans);
 
+void iwl_trans_pcie_ref(struct iwl_trans *trans);
+void iwl_trans_pcie_unref(struct iwl_trans *trans);
+
 static inline u16 iwl_pcie_tfd_tb_get_len(struct iwl_tfd *tfd, u8 idx)
 {
         struct iwl_tfd_tb *tb = &tfd->tbs[idx];
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 523fe0c88dcb..69935aa5a1b3 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -75,6 +75,7 @@
 #include "iwl-trans.h"
 #include "iwl-csr.h"
 #include "iwl-prph.h"
+#include "iwl-scd.h"
 #include "iwl-agn-hw.h"
 #include "iwl-fw-error-dump.h"
 #include "internal.h"
@@ -443,10 +444,25 @@ static int iwl_pcie_apm_stop_master(struct iwl_trans *trans)
         return ret;
 }
 
-static void iwl_pcie_apm_stop(struct iwl_trans *trans)
+static void iwl_pcie_apm_stop(struct iwl_trans *trans, bool op_mode_leave)
 {
         IWL_DEBUG_INFO(trans, "Stop card, put in low power state\n");
 
+        if (op_mode_leave) {
+                if (!test_bit(STATUS_DEVICE_ENABLED, &trans->status))
+                        iwl_pcie_apm_init(trans);
+
+                /* inform ME that we are leaving */
+                if (trans->cfg->device_family == IWL_DEVICE_FAMILY_7000)
+                        iwl_set_bits_prph(trans, APMG_PCIDEV_STT_REG,
+                                          APMG_PCIDEV_STT_VAL_WAKE_ME);
+                else if (trans->cfg->device_family == IWL_DEVICE_FAMILY_8000)
+                        iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
+                                    CSR_HW_IF_CONFIG_REG_PREPARE |
+                                    CSR_HW_IF_CONFIG_REG_ENABLE_PME);
+                mdelay(5);
+        }
+
         clear_bit(STATUS_DEVICE_ENABLED, &trans->status);
 
         /* Stop device's DMA activity */
@@ -707,6 +723,11 @@ static int iwl_pcie_load_cpu_sections_8000b(struct iwl_trans *trans,
 
         *first_ucode_section = last_read_idx;
 
+        if (cpu == 1)
+                iwl_write_direct32(trans, FH_UCODE_LOAD_STATUS, 0xFFFF);
+        else
+                iwl_write_direct32(trans, FH_UCODE_LOAD_STATUS, 0xFFFFFFFF);
+
         return 0;
 }
 
@@ -893,8 +914,8 @@ static int iwl_pcie_load_given_ucode_8000b(struct iwl_trans *trans,
         if (ret)
                 return ret;
 
-        /* Notify FW loading is done */
-        iwl_write_direct32(trans, FH_UCODE_LOAD_STATUS, 0xFFFFFFFF);
+        if (trans->dbg_dest_tlv)
+                iwl_pcie_apply_destination(trans);
 
         /* wait for image verification to complete  */
         ret = iwl_poll_prph_bit(trans, LMPM_SECURE_BOOT_CPU1_STATUS_ADDR_B0,
@@ -916,6 +937,7 @@ static int iwl_pcie_load_given_ucode_8000b(struct iwl_trans *trans,
 static int iwl_trans_pcie_start_fw(struct iwl_trans *trans,
                                    const struct fw_img *fw, bool run_in_rfkill)
 {
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         int ret;
         bool hw_rfkill;
 
@@ -945,6 +967,9 @@ static int iwl_trans_pcie_start_fw(struct iwl_trans *trans,
                 return ret;
         }
 
+        /* init ref_count to 1 (should be cleared when ucode is loaded) */
+        trans_pcie->ref_count = 1;
+
         /* make sure rfkill handshake bits are cleared */
         iwl_write32(trans, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
         iwl_write32(trans, CSR_UCODE_DRV_GP1_CLR,
@@ -960,7 +985,7 @@ static int iwl_trans_pcie_start_fw(struct iwl_trans *trans,
 
         /* Load the given image to the HW */
         if ((trans->cfg->device_family == IWL_DEVICE_FAMILY_8000) &&
-            (CSR_HW_REV_STEP(trans->hw_rev) == SILICON_B_STEP))
+            (CSR_HW_REV_STEP(trans->hw_rev) != SILICON_A_STEP))
                 return iwl_pcie_load_given_ucode_8000b(trans, fw);
         else
                 return iwl_pcie_load_given_ucode(trans, fw);
@@ -1010,7 +1035,7 @@ static void iwl_trans_pcie_stop_device(struct iwl_trans *trans)
                       CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
 
         /* Stop the device, and put it in low power state */
-        iwl_pcie_apm_stop(trans);
+        iwl_pcie_apm_stop(trans, false);
 
         /* stop and reset the on-board processor */
         iwl_write32(trans, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
@@ -1192,7 +1217,7 @@ static void iwl_trans_pcie_op_mode_leave(struct iwl_trans *trans)
         iwl_disable_interrupts(trans);
         spin_unlock(&trans_pcie->irq_lock);
 
-        iwl_pcie_apm_stop(trans);
+        iwl_pcie_apm_stop(trans, true);
 
         spin_lock(&trans_pcie->irq_lock);
         iwl_disable_interrupts(trans);
@@ -1244,6 +1269,7 @@ static void iwl_trans_pcie_configure(struct iwl_trans *trans,
 
         trans_pcie->cmd_queue = trans_cfg->cmd_queue;
         trans_pcie->cmd_fifo = trans_cfg->cmd_fifo;
+        trans_pcie->cmd_q_wdg_timeout = trans_cfg->cmd_q_wdg_timeout;
         if (WARN_ON(trans_cfg->n_no_reclaim_cmds > MAX_NO_RECLAIM_CMDS))
                 trans_pcie->n_no_reclaim_cmds = 0;
         else
@@ -1258,9 +1284,6 @@ static void iwl_trans_pcie_configure(struct iwl_trans *trans,
         else
                 trans_pcie->rx_page_order = get_order(4 * 1024);
 
-        trans_pcie->wd_timeout =
-                msecs_to_jiffies(trans_cfg->queue_watchdog_timeout);
-
         trans_pcie->command_names = trans_cfg->command_names;
         trans_pcie->bc_table_dword = trans_cfg->bc_table_dword;
         trans_pcie->scd_set_active = trans_cfg->scd_set_active;
@@ -1540,6 +1563,38 @@ static void iwl_trans_pcie_set_bits_mask(struct iwl_trans *trans, u32 reg,
         spin_unlock_irqrestore(&trans_pcie->reg_lock, flags);
 }
 
+void iwl_trans_pcie_ref(struct iwl_trans *trans)
+{
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        unsigned long flags;
+
+        if (iwlwifi_mod_params.d0i3_disable)
+                return;
+
+        spin_lock_irqsave(&trans_pcie->ref_lock, flags);
+        IWL_DEBUG_RPM(trans, "ref_counter: %d\n", trans_pcie->ref_count);
+        trans_pcie->ref_count++;
+        spin_unlock_irqrestore(&trans_pcie->ref_lock, flags);
+}
+
+void iwl_trans_pcie_unref(struct iwl_trans *trans)
+{
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        unsigned long flags;
+
+        if (iwlwifi_mod_params.d0i3_disable)
+                return;
+
+        spin_lock_irqsave(&trans_pcie->ref_lock, flags);
+        IWL_DEBUG_RPM(trans, "ref_counter: %d\n", trans_pcie->ref_count);
+        if (WARN_ON_ONCE(trans_pcie->ref_count == 0)) {
+                spin_unlock_irqrestore(&trans_pcie->ref_lock, flags);
+                return;
+        }
+        trans_pcie->ref_count--;
+        spin_unlock_irqrestore(&trans_pcie->ref_lock, flags);
+}
+
 static const char *get_csr_string(int cmd)
 {
 #define IWL_CMD(x) case x: return #x
@@ -2264,6 +2319,9 @@ static const struct iwl_trans_ops trans_ops_pcie = {
         .release_nic_access = iwl_trans_pcie_release_nic_access,
         .set_bits_mask = iwl_trans_pcie_set_bits_mask,
 
+        .ref = iwl_trans_pcie_ref,
+        .unref = iwl_trans_pcie_unref,
+
         .dump_data = iwl_trans_pcie_dump_data,
 };
 
@@ -2291,6 +2349,7 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
         trans_pcie->trans = trans;
         spin_lock_init(&trans_pcie->irq_lock);
         spin_lock_init(&trans_pcie->reg_lock);
+        spin_lock_init(&trans_pcie->ref_lock);
         init_waitqueue_head(&trans_pcie->ucode_write_waitq);
 
         err = pci_enable_device(pdev);
@@ -2404,6 +2463,7 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
         }
 
         trans_pcie->inta_mask = CSR_INI_SET_MASK;
+        trans->d0i3_mode = IWL_D0I3_MODE_ON_SUSPEND;
 
         return trans;
 
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index 8a6c7a084aa1..af0bce736358 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -147,7 +147,6 @@ static void iwl_pcie_free_dma_ptr(struct iwl_trans *trans,
 static void iwl_pcie_txq_stuck_timer(unsigned long data)
 {
         struct iwl_txq *txq = (void *)data;
-        struct iwl_queue *q = &txq->q;
         struct iwl_trans_pcie *trans_pcie = txq->trans_pcie;
         struct iwl_trans *trans = iwl_trans_pcie_get_trans(trans_pcie);
         u32 scd_sram_addr = trans_pcie->scd_base_addr +
@@ -164,7 +163,7 @@ static void iwl_pcie_txq_stuck_timer(unsigned long data)
         spin_unlock(&txq->lock);
 
         IWL_ERR(trans, "Queue %d stuck for %u ms.\n", txq->q.id,
-                jiffies_to_msecs(trans_pcie->wd_timeout));
+                jiffies_to_msecs(txq->wd_timeout));
         IWL_ERR(trans, "Current SW read_ptr %d write_ptr %d\n",
                 txq->q.read_ptr, txq->q.write_ptr);
 
@@ -198,11 +197,6 @@ static void iwl_pcie_txq_stuck_timer(unsigned long data)
                         iwl_read_prph(trans, SCD_QUEUE_WRPTR(i)));
         }
 
-        for (i = q->read_ptr; i != q->write_ptr;
-             i = iwl_queue_inc_wrap(i))
-                IWL_ERR(trans, "scratch %d = 0x%08x\n", i,
-                        le32_to_cpu(txq->scratchbufs[i].scratch));
-
         iwl_force_nmi(trans);
 }
 
@@ -680,7 +674,8 @@ void iwl_pcie_tx_start(struct iwl_trans *trans, u32 scd_base_addr)
                 iwl_write_prph(trans, SCD_CHAINEXT_EN, 0);
 
         iwl_trans_ac_txq_enable(trans, trans_pcie->cmd_queue,
-                                trans_pcie->cmd_fifo);
+                                trans_pcie->cmd_fifo,
+                                trans_pcie->cmd_q_wdg_timeout);
 
         /* Activate all Tx DMA/FIFO channels */
         iwl_scd_activate_fifos(trans);
@@ -722,7 +717,12 @@ void iwl_trans_pcie_tx_reset(struct iwl_trans *trans)
         iwl_write_direct32(trans, FH_KW_MEM_ADDR_REG,
                            trans_pcie->kw.dma >> 4);
 
-        iwl_pcie_tx_start(trans, trans_pcie->scd_base_addr);
+        /*
+         * Send 0 as the scd_base_addr since the device may have be reset
+         * while we were in WoWLAN in which case SCD_SRAM_BASE_ADDR will
+         * contain garbage.
+         */
+        iwl_pcie_tx_start(trans, 0);
 }
 
 /*
@@ -898,6 +898,10 @@ int iwl_pcie_tx_init(struct iwl_trans *trans)
                 }
         }
 
+        if (trans->cfg->base_params->num_of_queues > 20)
+                iwl_set_bits_prph(trans, SCD_GP_CTRL,
+                                  SCD_GP_CTRL_ENABLE_31_QUEUES);
+
         return 0;
 error:
         /*Upon error, free only if we allocated something */
@@ -906,10 +910,9 @@ error:
         return ret;
 }
 
-static inline void iwl_pcie_txq_progress(struct iwl_trans_pcie *trans_pcie,
-                                           struct iwl_txq *txq)
+static inline void iwl_pcie_txq_progress(struct iwl_txq *txq)
 {
-        if (!trans_pcie->wd_timeout)
+        if (!txq->wd_timeout)
                 return;
 
         /*
@@ -919,7 +922,7 @@ static inline void iwl_pcie_txq_progress(struct iwl_trans_pcie *trans_pcie,
         if (txq->q.read_ptr == txq->q.write_ptr)
                 del_timer(&txq->stuck_timer);
         else
-                mod_timer(&txq->stuck_timer, jiffies + trans_pcie->wd_timeout);
+                mod_timer(&txq->stuck_timer, jiffies + txq->wd_timeout);
 }
 
 /* Frees buffers until index _not_ inclusive */
@@ -981,21 +984,35 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
                 iwl_pcie_txq_free_tfd(trans, txq);
         }
 
-        iwl_pcie_txq_progress(trans_pcie, txq);
+        iwl_pcie_txq_progress(txq);
 
         if (iwl_queue_space(&txq->q) > txq->q.low_mark)
                 iwl_wake_queue(trans, txq);
+
+        if (q->read_ptr == q->write_ptr) {
+                IWL_DEBUG_RPM(trans, "Q %d - last tx reclaimed\n", q->id);
+                iwl_trans_pcie_unref(trans);
+        }
+
 out:
         spin_unlock_bh(&txq->lock);
 }
 
-static int iwl_pcie_set_cmd_in_flight(struct iwl_trans *trans)
+static int iwl_pcie_set_cmd_in_flight(struct iwl_trans *trans,
+                                      const struct iwl_host_cmd *cmd)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         int ret;
 
         lockdep_assert_held(&trans_pcie->reg_lock);
 
+        if (!(cmd->flags & CMD_SEND_IN_IDLE) &&
+            !trans_pcie->ref_cmd_in_flight) {
+                trans_pcie->ref_cmd_in_flight = true;
+                IWL_DEBUG_RPM(trans, "set ref_cmd_in_flight - ref\n");
+                iwl_trans_pcie_ref(trans);
+        }
+
         if (trans_pcie->cmd_in_flight)
                 return 0;
 
@@ -1036,6 +1053,12 @@ static int iwl_pcie_clear_cmd_in_flight(struct iwl_trans *trans)
 
         lockdep_assert_held(&trans_pcie->reg_lock);
 
+        if (trans_pcie->ref_cmd_in_flight) {
+                trans_pcie->ref_cmd_in_flight = false;
+                IWL_DEBUG_RPM(trans, "clear ref_cmd_in_flight - unref\n");
+                iwl_trans_pcie_unref(trans);
+        }
+
         if (WARN_ON(!trans_pcie->cmd_in_flight))
                 return 0;
 
@@ -1089,7 +1112,7 @@ static void iwl_pcie_cmdq_reclaim(struct iwl_trans *trans, int txq_id, int idx)
                 spin_unlock_irqrestore(&trans_pcie->reg_lock, flags);
         }
 
-        iwl_pcie_txq_progress(trans_pcie, txq);
+        iwl_pcie_txq_progress(txq);
 }
 
 static int iwl_pcie_txq_set_ratid_map(struct iwl_trans *trans, u16 ra_tid,
@@ -1122,14 +1145,18 @@ static int iwl_pcie_txq_set_ratid_map(struct iwl_trans *trans, u16 ra_tid,
 #define BUILD_RAxTID(sta_id, tid)       (((sta_id) << 4) + (tid))
 
 void iwl_trans_pcie_txq_enable(struct iwl_trans *trans, int txq_id, u16 ssn,
-                               const struct iwl_trans_txq_scd_cfg *cfg)
+                               const struct iwl_trans_txq_scd_cfg *cfg,
+                               unsigned int wdg_timeout)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        struct iwl_txq *txq = &trans_pcie->txq[txq_id];
         int fifo = -1;
 
         if (test_and_set_bit(txq_id, trans_pcie->queue_used))
                 WARN_ONCE(1, "queue %d already used - expect issues", txq_id);
 
+        txq->wd_timeout = msecs_to_jiffies(wdg_timeout);
+
         if (cfg) {
                 fifo = cfg->fifo;
 
@@ -1153,7 +1180,7 @@ void iwl_trans_pcie_txq_enable(struct iwl_trans *trans, int txq_id, u16 ssn,
 
                         /* enable aggregations for the queue */
                         iwl_scd_txq_enable_agg(trans, txq_id);
-                        trans_pcie->txq[txq_id].ampdu = true;
+                        txq->ampdu = true;
                 } else {
                         /*
                          * disable aggregations for the queue, this will also
@@ -1162,20 +1189,20 @@ void iwl_trans_pcie_txq_enable(struct iwl_trans *trans, int txq_id, u16 ssn,
                          */
                         iwl_scd_txq_disable_agg(trans, txq_id);
 
-                        ssn = trans_pcie->txq[txq_id].q.read_ptr;
+                        ssn = txq->q.read_ptr;
                 }
         }
 
         /* Place first TFD at index corresponding to start sequence number.
          * Assumes that ssn_idx is valid (!= 0xFFF) */
-        trans_pcie->txq[txq_id].q.read_ptr = (ssn & 0xff);
-        trans_pcie->txq[txq_id].q.write_ptr = (ssn & 0xff);
+        txq->q.read_ptr = (ssn & 0xff);
+        txq->q.write_ptr = (ssn & 0xff);
+        iwl_write_direct32(trans, HBUS_TARG_WRPTR,
+                           (ssn & 0xff) | (txq_id << 8));
 
         if (cfg) {
                 u8 frame_limit = cfg->frame_limit;
 
-                iwl_write_direct32(trans, HBUS_TARG_WRPTR,
-                                   (ssn & 0xff) | (txq_id << 8));
                 iwl_write_prph(trans, SCD_QUEUE_RDPTR(txq_id), ssn);
 
                 /* Set up Tx window size and frame limit for this queue */
@@ -1200,11 +1227,17 @@ void iwl_trans_pcie_txq_enable(struct iwl_trans *trans, int txq_id, u16 ssn,
                 if (txq_id == trans_pcie->cmd_queue &&
                     trans_pcie->scd_set_active)
                         iwl_scd_enable_set_active(trans, BIT(txq_id));
+
+                IWL_DEBUG_TX_QUEUES(trans,
+                                    "Activate queue %d on FIFO %d WrPtr: %d\n",
+                                    txq_id, fifo, ssn & 0xff);
+        } else {
+                IWL_DEBUG_TX_QUEUES(trans,
+                                    "Activate queue %d WrPtr: %d\n",
+                                    txq_id, ssn & 0xff);
         }
 
-        trans_pcie->txq[txq_id].active = true;
-        IWL_DEBUG_TX_QUEUES(trans, "Activate queue %d on FIFO %d WrPtr: %d\n",
-                            txq_id, fifo, ssn & 0xff);
+        txq->active = true;
 }
 
 void iwl_trans_pcie_txq_disable(struct iwl_trans *trans, int txq_id,
@@ -1469,11 +1502,11 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
         trace_iwlwifi_dev_hcmd(trans->dev, cmd, cmd_size, &out_cmd->hdr);
 
         /* start timer if queue currently empty */
-        if (q->read_ptr == q->write_ptr && trans_pcie->wd_timeout)
-                mod_timer(&txq->stuck_timer, jiffies + trans_pcie->wd_timeout);
+        if (q->read_ptr == q->write_ptr && txq->wd_timeout)
+                mod_timer(&txq->stuck_timer, jiffies + txq->wd_timeout);
 
         spin_lock_irqsave(&trans_pcie->reg_lock, flags);
-        ret = iwl_pcie_set_cmd_in_flight(trans);
+        ret = iwl_pcie_set_cmd_in_flight(trans, cmd);
         if (ret < 0) {
                 idx = ret;
                 spin_unlock_irqrestore(&trans_pcie->reg_lock, flags);
@@ -1819,9 +1852,12 @@ int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
         wait_write_ptr = ieee80211_has_morefrags(fc);
 
         /* start timer if queue currently empty */
-        if (txq->need_update && q->read_ptr == q->write_ptr &&
-            trans_pcie->wd_timeout)
-                mod_timer(&txq->stuck_timer, jiffies + trans_pcie->wd_timeout);
+        if (q->read_ptr == q->write_ptr) {
+                if (txq->wd_timeout)
+                        mod_timer(&txq->stuck_timer, jiffies + txq->wd_timeout);
+                IWL_DEBUG_RPM(trans, "Q: %d first tx - take ref\n", q->id);
+                iwl_trans_pcie_ref(trans);
+        }
 
         /* Tell device the write index *just past* this latest filled TFD */
         q->write_ptr = iwl_queue_inc_wrap(q->write_ptr);
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index 34f09ef90bb3..a92985a6ea21 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -1616,10 +1616,10 @@ static int lbs_cfg_get_station(struct wiphy *wiphy, struct net_device *dev,
 
         lbs_deb_enter(LBS_DEB_CFG80211);
 
-        sinfo->filled |= STATION_INFO_TX_BYTES |
-                         STATION_INFO_TX_PACKETS |
-                         STATION_INFO_RX_BYTES |
-                         STATION_INFO_RX_PACKETS;
+        sinfo->filled |= BIT(NL80211_STA_INFO_TX_BYTES) |
+                         BIT(NL80211_STA_INFO_TX_PACKETS) |
+                         BIT(NL80211_STA_INFO_RX_BYTES) |
+                         BIT(NL80211_STA_INFO_RX_PACKETS);
         sinfo->tx_bytes = priv->dev->stats.tx_bytes;
         sinfo->tx_packets = priv->dev->stats.tx_packets;
         sinfo->rx_bytes = priv->dev->stats.rx_bytes;
@@ -1629,14 +1629,14 @@ static int lbs_cfg_get_station(struct wiphy *wiphy, struct net_device *dev,
         ret = lbs_get_rssi(priv, &signal, &noise);
         if (ret == 0) {
                 sinfo->signal = signal;
-                sinfo->filled |= STATION_INFO_SIGNAL;
+                sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
         }
 
         /* Convert priv->cur_rate from hw_value to NL80211 value */
         for (i = 0; i < ARRAY_SIZE(lbs_rates); i++) {
                 if (priv->cur_rate == lbs_rates[i].hw_value) {
                         sinfo->txrate.legacy = lbs_rates[i].bitrate;
-                        sinfo->filled |= STATION_INFO_TX_BITRATE;
+                        sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
                         break;
                 }
         }
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index ef58a8862d91..4a4c6586a8d2 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -625,22 +625,22 @@ static int hwsim_fops_ps_write(void *dat, u64 val)
         old_ps = data->ps;
         data->ps = val;
 
+        local_bh_disable();
         if (val == PS_MANUAL_POLL) {
-                ieee80211_iterate_active_interfaces(data->hw,
-                                                    IEEE80211_IFACE_ITER_NORMAL,
-                                                    hwsim_send_ps_poll, data);
+                ieee80211_iterate_active_interfaces_atomic(
+                        data->hw, IEEE80211_IFACE_ITER_NORMAL,
+                        hwsim_send_ps_poll, data);
                 data->ps_poll_pending = true;
         } else if (old_ps == PS_DISABLED && val != PS_DISABLED) {
-                ieee80211_iterate_active_interfaces(data->hw,
-                                                    IEEE80211_IFACE_ITER_NORMAL,
-                                                    hwsim_send_nullfunc_ps,
-                                                    data);
+                ieee80211_iterate_active_interfaces_atomic(
+                        data->hw, IEEE80211_IFACE_ITER_NORMAL,
+                        hwsim_send_nullfunc_ps, data);
         } else if (old_ps != PS_DISABLED && val == PS_DISABLED) {
-                ieee80211_iterate_active_interfaces(data->hw,
-                                                    IEEE80211_IFACE_ITER_NORMAL,
-                                                    hwsim_send_nullfunc_no_ps,
-                                                    data);
+                ieee80211_iterate_active_interfaces_atomic(
+                        data->hw, IEEE80211_IFACE_ITER_NORMAL,
+                        hwsim_send_nullfunc_no_ps, data);
         }
+        local_bh_enable();
 
         return 0;
 }
@@ -2149,14 +2149,14 @@ static int append_radio_msg(struct sk_buff *skb, int id,
         if (param->regd) {
                 int i;
 
-                for (i = 0; hwsim_world_regdom_custom[i] != param->regd &&
-                     i < ARRAY_SIZE(hwsim_world_regdom_custom); i++)
-                        ;
+                for (i = 0; i < ARRAY_SIZE(hwsim_world_regdom_custom); i++) {
+                        if (hwsim_world_regdom_custom[i] != param->regd)
+                                continue;
 
-                if (i < ARRAY_SIZE(hwsim_world_regdom_custom)) {
                         ret = nla_put_u32(skb, HWSIM_ATTR_REG_CUSTOM_REG, i);
                         if (ret < 0)
                                 return ret;
+                        break;
                 }
         }
 
@@ -2557,7 +2557,8 @@ static int mac80211_hwsim_get_radio(struct sk_buff *skb,
         if (res < 0)
                 goto out_err;
 
-        return genlmsg_end(skb, hdr);
+        genlmsg_end(skb, hdr);
+        return 0;
 
 out_err:
         genlmsg_cancel(skb, hdr);
diff --git a/drivers/net/wireless/mwifiex/11h.c b/drivers/net/wireless/mwifiex/11h.c
index 2668e83afbb6..3ab87a855122 100644
--- a/drivers/net/wireless/mwifiex/11h.c
+++ b/drivers/net/wireless/mwifiex/11h.c
@@ -21,6 +21,16 @@
 #include "fw.h"
 
 
+void mwifiex_init_11h_params(struct mwifiex_private *priv)
+{
+        priv->state_11h.is_11h_enabled = true;
+        priv->state_11h.is_11h_active = false;
+}
+
+inline int mwifiex_is_11h_active(struct mwifiex_private *priv)
+{
+        return priv->state_11h.is_11h_active;
+}
 /* This function appends 11h info to a buffer while joining an
  * infrastructure BSS
  */
@@ -39,7 +49,7 @@ mwifiex_11h_process_infra_join(struct mwifiex_private *priv, u8 **buffer,
                 return;
 
         radio_type = mwifiex_band_to_radio_type((u8) bss_desc->bss_band);
-        sband = priv->wdev->wiphy->bands[radio_type];
+        sband = priv->wdev.wiphy->bands[radio_type];
 
         cap = (struct mwifiex_ie_types_pwr_capability *)*buffer;
         cap->header.type = cpu_to_le16(WLAN_EID_PWR_CAPABILITY);
@@ -69,10 +79,14 @@ mwifiex_11h_process_infra_join(struct mwifiex_private *priv, u8 **buffer,
 }
 
 /* Enable or disable the 11h extensions in the firmware */
-static int mwifiex_11h_activate(struct mwifiex_private *priv, bool flag)
+int mwifiex_11h_activate(struct mwifiex_private *priv, bool flag)
 {
         u32 enable = flag;
 
+        /* enable master mode radar detection on AP interface */
+        if ((GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_UAP) && enable)
+                enable |= MWIFIEX_MASTER_RADAR_DET_MASK;
+
         return mwifiex_send_cmd(priv, HostCmd_CMD_802_11_SNMP_MIB,
                                 HostCmd_ACT_GEN_SET, DOT11H_I, &enable, true);
 }
@@ -91,11 +105,191 @@ void mwifiex_11h_process_join(struct mwifiex_private *priv, u8 **buffer,
                  * bit
                  */
                 mwifiex_11h_activate(priv, true);
+                priv->state_11h.is_11h_active = true;
                 bss_desc->cap_info_bitmap |= WLAN_CAPABILITY_SPECTRUM_MGMT;
                 mwifiex_11h_process_infra_join(priv, buffer, bss_desc);
         } else {
                 /* Deactivate 11h functions in the firmware */
                 mwifiex_11h_activate(priv, false);
+                priv->state_11h.is_11h_active = false;
                 bss_desc->cap_info_bitmap &= ~WLAN_CAPABILITY_SPECTRUM_MGMT;
         }
 }
+
+/* This is DFS CAC work queue function.
+ * This delayed work emits CAC finished event for cfg80211 if
+ * CAC was started earlier.
+ */
+void mwifiex_dfs_cac_work_queue(struct work_struct *work)
+{
+        struct cfg80211_chan_def chandef;
+        struct delayed_work *delayed_work =
+                        container_of(work, struct delayed_work, work);
+        struct mwifiex_private *priv =
+                        container_of(delayed_work, struct mwifiex_private,
+                                     dfs_cac_work);
+
+        if (WARN_ON(!priv))
+                return;
+
+        chandef = priv->dfs_chandef;
+        if (priv->wdev.cac_started) {
+                dev_dbg(priv->adapter->dev,
+                        "CAC timer finished; No radar detected\n");
+                cfg80211_cac_event(priv->netdev, &chandef,
+                                   NL80211_RADAR_CAC_FINISHED,
+                                   GFP_KERNEL);
+        }
+}
+
+/* This function prepares channel report request command to FW for
+ * starting radar detection.
+ */
+int mwifiex_cmd_issue_chan_report_request(struct mwifiex_private *priv,
+                                          struct host_cmd_ds_command *cmd,
+                                          void *data_buf)
+{
+        struct host_cmd_ds_chan_rpt_req *cr_req = &cmd->params.chan_rpt_req;
+        struct mwifiex_radar_params *radar_params = (void *)data_buf;
+
+        cmd->command = cpu_to_le16(HostCmd_CMD_CHAN_REPORT_REQUEST);
+        cmd->size = cpu_to_le16(S_DS_GEN);
+        le16_add_cpu(&cmd->size, sizeof(struct host_cmd_ds_chan_rpt_req));
+
+        cr_req->chan_desc.start_freq = cpu_to_le16(MWIFIEX_A_BAND_START_FREQ);
+        cr_req->chan_desc.chan_num = radar_params->chandef->chan->hw_value;
+        cr_req->chan_desc.chan_width = radar_params->chandef->width;
+        cr_req->msec_dwell_time = cpu_to_le32(radar_params->cac_time_ms);
+
+        dev_dbg(priv->adapter->dev,
+                "11h: issuing DFS Radar check for channel=%d\n",
+                radar_params->chandef->chan->hw_value);
+
+        return 0;
+}
+
+/* This function is to abort ongoing CAC upon stopping AP operations
+ * or during unload.
+ */
+void mwifiex_abort_cac(struct mwifiex_private *priv)
+{
+        if (priv->wdev.cac_started) {
+                dev_dbg(priv->adapter->dev,
+                        "Aborting delayed work for CAC.\n");
+                cancel_delayed_work_sync(&priv->dfs_cac_work);
+                cfg80211_cac_event(priv->netdev, &priv->dfs_chandef,
+                                   NL80211_RADAR_CAC_ABORTED, GFP_KERNEL);
+        }
+}
+
+/* This function handles channel report event from FW during CAC period.
+ * If radar is detected during CAC, driver indicates the same to cfg80211
+ * and also cancels ongoing delayed work.
+ */
+int mwifiex_11h_handle_chanrpt_ready(struct mwifiex_private *priv,
+                                     struct sk_buff *skb)
+{
+        struct host_cmd_ds_chan_rpt_event *rpt_event;
+        struct mwifiex_ie_types_chan_rpt_data *rpt;
+        u8 *evt_buf;
+        u16 event_len, tlv_len;
+
+        rpt_event = (void *)(skb->data + sizeof(u32));
+        event_len = skb->len - (sizeof(struct host_cmd_ds_chan_rpt_event)+
+                                sizeof(u32));
+
+        if (le32_to_cpu(rpt_event->result) != HostCmd_RESULT_OK) {
+                dev_err(priv->adapter->dev, "Error in channel report event\n");
+                return -1;
+        }
+
+        evt_buf = (void *)&rpt_event->tlvbuf;
+
+        while (event_len >= sizeof(struct mwifiex_ie_types_header)) {
+                rpt = (void *)&rpt_event->tlvbuf;
+                tlv_len = le16_to_cpu(rpt->header.len);
+
+                switch (le16_to_cpu(rpt->header.type)) {
+                case TLV_TYPE_CHANRPT_11H_BASIC:
+                        if (rpt->map.radar) {
+                                dev_notice(priv->adapter->dev,
+                                           "RADAR Detected on channel %d!\n",
+                                            priv->dfs_chandef.chan->hw_value);
+                                cancel_delayed_work_sync(&priv->dfs_cac_work);
+                                cfg80211_cac_event(priv->netdev,
+                                                   &priv->dfs_chandef,
+                                                   NL80211_RADAR_DETECTED,
+                                                   GFP_KERNEL);
+                        }
+                        break;
+                default:
+                        break;
+                }
+
+                evt_buf += (tlv_len + sizeof(rpt->header));
+                event_len -= (tlv_len + sizeof(rpt->header));
+        }
+
+        return 0;
+}
+
+/* Handler for radar detected event from FW.*/
+int mwifiex_11h_handle_radar_detected(struct mwifiex_private *priv,
+                                      struct sk_buff *skb)
+{
+        struct mwifiex_radar_det_event *rdr_event;
+
+        rdr_event = (void *)(skb->data + sizeof(u32));
+
+        if (le32_to_cpu(rdr_event->passed)) {
+                dev_notice(priv->adapter->dev,
+                           "radar detected; indicating kernel\n");
+                cfg80211_radar_event(priv->adapter->wiphy, &priv->dfs_chandef,
+                                     GFP_KERNEL);
+                dev_dbg(priv->adapter->dev, "regdomain: %d\n",
+                        rdr_event->reg_domain);
+                dev_dbg(priv->adapter->dev, "radar detection type: %d\n",
+                        rdr_event->det_type);
+        } else {
+                dev_dbg(priv->adapter->dev, "false radar detection event!\n");
+        }
+
+        return 0;
+}
+
+/* This is work queue function for channel switch handling.
+ * This function takes care of updating new channel definitin to
+ * bss config structure, restart AP and indicate channel switch success
+ * to cfg80211.
+ */
+void mwifiex_dfs_chan_sw_work_queue(struct work_struct *work)
+{
+        struct mwifiex_uap_bss_param *bss_cfg;
+        struct delayed_work *delayed_work =
+                        container_of(work, struct delayed_work, work);
+        struct mwifiex_private *priv =
+                        container_of(delayed_work, struct mwifiex_private,
+                                     dfs_chan_sw_work);
+
+        if (WARN_ON(!priv))
+                return;
+
+        bss_cfg = &priv->bss_cfg;
+        if (!bss_cfg->beacon_period) {
+                dev_err(priv->adapter->dev,
+                        "channel switch: AP already stopped\n");
+                return;
+        }
+
+        mwifiex_uap_set_channel(bss_cfg, priv->dfs_chandef);
+
+        if (mwifiex_config_start_uap(priv, bss_cfg)) {
+                dev_dbg(priv->adapter->dev,
+                        "Failed to start AP after channel switch\n");
+                return;
+        }
+
+        dev_notice(priv->adapter->dev,
+                   "indicating channel switch completion to kernel\n");
+        cfg80211_ch_switch_notify(priv->netdev, &priv->dfs_chandef);
+}
diff --git a/drivers/net/wireless/mwifiex/11n.c b/drivers/net/wireless/mwifiex/11n.c
index 9d4786e7ddff..543148d27b01 100644
--- a/drivers/net/wireless/mwifiex/11n.c
+++ b/drivers/net/wireless/mwifiex/11n.c
@@ -39,7 +39,7 @@ int mwifiex_fill_cap_info(struct mwifiex_private *priv, u8 radio_type,
 {
         uint16_t ht_ext_cap = le16_to_cpu(ht_cap->extended_ht_cap_info);
         struct ieee80211_supported_band *sband =
-                                        priv->wdev->wiphy->bands[radio_type];
+                                        priv->wdev.wiphy->bands[radio_type];
 
         if (WARN_ON_ONCE(!sband)) {
                 dev_err(priv->adapter->dev, "Invalid radio type!\n");
@@ -314,7 +314,7 @@ mwifiex_cmd_append_11n_tlv(struct mwifiex_private *priv,
                 return ret_len;
 
         radio_type = mwifiex_band_to_radio_type((u8) bss_desc->bss_band);
-        sband = priv->wdev->wiphy->bands[radio_type];
+        sband = priv->wdev.wiphy->bands[radio_type];
 
         if (bss_desc->bcn_ht_cap) {
                 ht_cap = (struct mwifiex_ie_types_htcap *) *buffer;
@@ -558,10 +558,10 @@ int mwifiex_send_addba(struct mwifiex_private *priv, int tid, u8 *peer_mac)
                 spin_lock_irqsave(&priv->sta_list_spinlock, flags);
                 sta_ptr = mwifiex_get_sta_entry(priv, peer_mac);
                 if (!sta_ptr) {
+                        spin_unlock_irqrestore(&priv->sta_list_spinlock, flags);
                         dev_warn(priv->adapter->dev,
                                  "BA setup with unknown TDLS peer %pM!\n",
                                 peer_mac);
-                        spin_unlock_irqrestore(&priv->sta_list_spinlock, flags);
                         return -1;
                 }
                 if (sta_ptr->is_11ac_enabled)
diff --git a/drivers/net/wireless/mwifiex/11n.h b/drivers/net/wireless/mwifiex/11n.h
index f275675cdbd3..8e2e39422ad8 100644
--- a/drivers/net/wireless/mwifiex/11n.h
+++ b/drivers/net/wireless/mwifiex/11n.h
@@ -130,7 +130,9 @@ static inline u8 mwifiex_space_avail_for_new_ba_stream(
 {
         struct mwifiex_private *priv;
         u8 i;
-        u32 ba_stream_num = 0;
+        u32 ba_stream_num = 0, ba_stream_max;
+
+        ba_stream_max = MWIFIEX_MAX_TX_BASTREAM_SUPPORTED;
 
         for (i = 0; i < adapter->priv_num; i++) {
                 priv = adapter->priv[i];
@@ -139,8 +141,14 @@ static inline u8 mwifiex_space_avail_for_new_ba_stream(
                                 &priv->tx_ba_stream_tbl_ptr);
         }
 
-        return ((ba_stream_num <
-                 MWIFIEX_MAX_TX_BASTREAM_SUPPORTED) ? true : false);
+        if (adapter->fw_api_ver == MWIFIEX_FW_V15) {
+                ba_stream_max =
+                               GETSUPP_TXBASTREAMS(adapter->hw_dot_11n_dev_cap);
+                if (!ba_stream_max)
+                        ba_stream_max = MWIFIEX_MAX_TX_BASTREAM_SUPPORTED;
+        }
+
+        return ((ba_stream_num < ba_stream_max) ? true : false);
 }
 
 /*
diff --git a/drivers/net/wireless/mwifiex/11n_aggr.c b/drivers/net/wireless/mwifiex/11n_aggr.c
index 8720a3d3c755..9b983b5cebbd 100644
--- a/drivers/net/wireless/mwifiex/11n_aggr.c
+++ b/drivers/net/wireless/mwifiex/11n_aggr.c
@@ -101,6 +101,13 @@ mwifiex_11n_form_amsdu_txpd(struct mwifiex_private *priv,
 {
         struct txpd *local_tx_pd;
         struct mwifiex_txinfo *tx_info = MWIFIEX_SKB_TXCB(skb);
+        unsigned int pad;
+        int headroom = (priv->adapter->iface_type ==
+                        MWIFIEX_USB) ? 0 : INTF_HEADER_LEN;
+
+        pad = ((void *)skb->data - sizeof(*local_tx_pd) -
+                headroom - NULL) & (MWIFIEX_DMA_ALIGN_SZ - 1);
+        skb_push(skb, pad);
 
         skb_push(skb, sizeof(*local_tx_pd));
 
@@ -114,10 +121,12 @@ mwifiex_11n_form_amsdu_txpd(struct mwifiex_private *priv,
         local_tx_pd->bss_num = priv->bss_num;
         local_tx_pd->bss_type = priv->bss_type;
         /* Always zero as the data is followed by struct txpd */
-        local_tx_pd->tx_pkt_offset = cpu_to_le16(sizeof(struct txpd));
+        local_tx_pd->tx_pkt_offset = cpu_to_le16(sizeof(struct txpd) +
+                                                 pad);
         local_tx_pd->tx_pkt_type = cpu_to_le16(PKT_TYPE_AMSDU);
         local_tx_pd->tx_pkt_length = cpu_to_le16(skb->len -
-                                                 sizeof(*local_tx_pd));
+                                                 sizeof(*local_tx_pd) -
+                                                 pad);
 
         if (tx_info->flags & MWIFIEX_BUF_FLAG_TDLS_PKT)
                 local_tx_pd->flags |= MWIFIEX_TXPD_FLAGS_TDLS_PACKET;
@@ -182,7 +191,7 @@ mwifiex_11n_aggregate_pkt(struct mwifiex_private *priv,
                                        ra_list_flags);
                 return -1;
         }
-        skb_reserve(skb_aggr, headroom + sizeof(struct txpd));
+        skb_reserve(skb_aggr, MWIFIEX_MIN_DATA_HEADER_LEN);
         tx_info_aggr =  MWIFIEX_SKB_TXCB(skb_aggr);
 
         memset(tx_info_aggr, 0, sizeof(*tx_info_aggr));
diff --git a/drivers/net/wireless/mwifiex/11n_rxreorder.c b/drivers/net/wireless/mwifiex/11n_rxreorder.c
index d73fda312c87..a2e8817b56d8 100644
--- a/drivers/net/wireless/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless/mwifiex/11n_rxreorder.c
@@ -45,7 +45,7 @@ static int mwifiex_11n_dispatch_amsdu_pkt(struct mwifiex_private *priv,
                 skb_trim(skb, le16_to_cpu(local_rx_pd->rx_pkt_length));
 
                 ieee80211_amsdu_to_8023s(skb, &list, priv->curr_addr,
-                                         priv->wdev->iftype, 0, false);
+                                         priv->wdev.iftype, 0, false);
 
                 while (!skb_queue_empty(&list)) {
                         rx_skb = __skb_dequeue(&list);
@@ -353,9 +353,6 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
 
         spin_lock_irqsave(&priv->sta_list_spinlock, flags);
         if (mwifiex_queuing_ra_based(priv)) {
-                dev_dbg(priv->adapter->dev,
-                        "info: AP/ADHOC:last_seq=%d start_win=%d\n",
-                        last_seq, new_node->start_win);
                 if (priv->bss_role == MWIFIEX_BSS_ROLE_UAP) {
                         node = mwifiex_get_sta_entry(priv, ta);
                         if (node)
@@ -370,6 +367,9 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
         }
         spin_unlock_irqrestore(&priv->sta_list_spinlock, flags);
 
+        dev_dbg(priv->adapter->dev, "info: last_seq=%d start_win=%d\n",
+                last_seq, new_node->start_win);
+
         if (last_seq != MWIFIEX_DEF_11N_RX_SEQ_NUM &&
             last_seq >= new_node->start_win) {
                 new_node->start_win = last_seq + 1;
@@ -391,10 +391,8 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
         new_node->timer_context.priv = priv;
         new_node->timer_context.timer_is_set = false;
 
-        init_timer(&new_node->timer_context.timer);
-        new_node->timer_context.timer.function = mwifiex_flush_data;
-        new_node->timer_context.timer.data =
-                        (unsigned long) &new_node->timer_context;
+        setup_timer(&new_node->timer_context.timer, mwifiex_flush_data,
+                    (unsigned long)&new_node->timer_context);
 
         for (i = 0; i < win_size; ++i)
                 new_node->rx_reorder_ptr[i] = NULL;
@@ -468,10 +466,10 @@ int mwifiex_cmd_11n_addba_rsp_gen(struct mwifiex_private *priv,
                 sta_ptr = mwifiex_get_sta_entry(priv,
                                                 cmd_addba_req->peer_mac_addr);
                 if (!sta_ptr) {
+                        spin_unlock_irqrestore(&priv->sta_list_spinlock, flags);
                         dev_warn(priv->adapter->dev,
                                  "BA setup with unknown TDLS peer %pM!\n",
                                  cmd_addba_req->peer_mac_addr);
-                        spin_unlock_irqrestore(&priv->sta_list_spinlock, flags);
                         return -1;
                 }
                 if (sta_ptr->is_11ac_enabled)
diff --git a/drivers/net/wireless/mwifiex/Makefile b/drivers/net/wireless/mwifiex/Makefile
index 9487d728ac20..fdfd9bf15ed4 100644
--- a/drivers/net/wireless/mwifiex/Makefile
+++ b/drivers/net/wireless/mwifiex/Makefile
@@ -53,3 +53,5 @@ obj-$(CONFIG_MWIFIEX_PCIE) += mwifiex_pcie.o
 
 mwifiex_usb-y += usb.o
 obj-$(CONFIG_MWIFIEX_USB) += mwifiex_usb.o
+
+ccflags-y += -D__CHECK_ENDIAN
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index 4a66a6555366..41c8e25df954 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -590,77 +590,62 @@ mwifiex_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
         struct mwifiex_adapter *adapter = mwifiex_cfg80211_get_adapter(wiphy);
         struct mwifiex_private *priv;
         struct mwifiex_uap_bss_param *bss_cfg;
-        int ret, bss_started, i;
-
-        for (i = 0; i < adapter->priv_num; i++) {
-                priv = adapter->priv[i];
-
-                switch (priv->bss_role) {
-                case MWIFIEX_BSS_ROLE_UAP:
-                        bss_cfg = kzalloc(sizeof(struct mwifiex_uap_bss_param),
-                                          GFP_KERNEL);
-                        if (!bss_cfg)
-                                return -ENOMEM;
-
-                        mwifiex_set_sys_config_invalid_data(bss_cfg);
-
-                        if (changed & WIPHY_PARAM_RTS_THRESHOLD)
-                                bss_cfg->rts_threshold = wiphy->rts_threshold;
-                        if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
-                                bss_cfg->frag_threshold = wiphy->frag_threshold;
-                        if (changed & WIPHY_PARAM_RETRY_LONG)
-                                bss_cfg->retry_limit = wiphy->retry_long;
-
-                        bss_started = priv->bss_started;
-
-                        ret = mwifiex_send_cmd(priv, HostCmd_CMD_UAP_BSS_STOP,
-                                               HostCmd_ACT_GEN_SET, 0,
-                                               NULL, true);
-                        if (ret) {
-                                wiphy_err(wiphy, "Failed to stop the BSS\n");
-                                kfree(bss_cfg);
-                                return ret;
-                        }
+        int ret;
 
-                        ret = mwifiex_send_cmd(priv, HostCmd_CMD_UAP_SYS_CONFIG,
-                                               HostCmd_ACT_GEN_SET,
-                                               UAP_BSS_PARAMS_I, bss_cfg,
-                                               false);
+        priv = mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_ANY);
 
-                        kfree(bss_cfg);
+        switch (priv->bss_role) {
+        case MWIFIEX_BSS_ROLE_UAP:
+                if (priv->bss_started) {
+                        dev_err(adapter->dev,
+                                "cannot change wiphy params when bss started");
+                        return -EINVAL;
+                }
 
-                        if (ret) {
-                                wiphy_err(wiphy, "Failed to set bss config\n");
-                                return ret;
-                        }
+                bss_cfg = kzalloc(sizeof(*bss_cfg), GFP_KERNEL);
+                if (!bss_cfg)
+                        return -ENOMEM;
 
-                        if (!bss_started)
-                                break;
+                mwifiex_set_sys_config_invalid_data(bss_cfg);
 
-                        ret = mwifiex_send_cmd(priv, HostCmd_CMD_UAP_BSS_START,
-                                               HostCmd_ACT_GEN_SET, 0,
-                                               NULL, false);
-                        if (ret) {
-                                wiphy_err(wiphy, "Failed to start BSS\n");
-                                return ret;
-                        }
+                if (changed & WIPHY_PARAM_RTS_THRESHOLD)
+                        bss_cfg->rts_threshold = wiphy->rts_threshold;
+                if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
+                        bss_cfg->frag_threshold = wiphy->frag_threshold;
+                if (changed & WIPHY_PARAM_RETRY_LONG)
+                        bss_cfg->retry_limit = wiphy->retry_long;
+
+                ret = mwifiex_send_cmd(priv, HostCmd_CMD_UAP_SYS_CONFIG,
+                                       HostCmd_ACT_GEN_SET,
+                                       UAP_BSS_PARAMS_I, bss_cfg,
+                                       false);
+
+                kfree(bss_cfg);
+                if (ret) {
+                        wiphy_err(wiphy, "Failed to set wiphy phy params\n");
+                        return ret;
+                }
+                break;
 
-                        break;
                 case MWIFIEX_BSS_ROLE_STA:
-                        if (changed & WIPHY_PARAM_RTS_THRESHOLD) {
-                                ret = mwifiex_set_rts(priv,
-                                                      wiphy->rts_threshold);
-                                if (ret)
-                                        return ret;
-                        }
-                        if (changed & WIPHY_PARAM_FRAG_THRESHOLD) {
-                                ret = mwifiex_set_frag(priv,
-                                                       wiphy->frag_threshold);
-                                if (ret)
-                                        return ret;
-                        }
-                        break;
+                if (priv->media_connected) {
+                        dev_err(adapter->dev,
+                                "cannot change wiphy params when connected");
+                        return -EINVAL;
                 }
+                if (changed & WIPHY_PARAM_RTS_THRESHOLD) {
+                        ret = mwifiex_set_rts(priv,
+                                              wiphy->rts_threshold);
+                        if (ret)
+                                return ret;
+                }
+                if (changed & WIPHY_PARAM_FRAG_THRESHOLD) {
+                        ret = mwifiex_set_frag(priv,
+                                               wiphy->frag_threshold);
+                        if (ret)
+                                return ret;
+                }
+                break;
         }
 
         return 0;
@@ -671,9 +656,6 @@ mwifiex_cfg80211_deinit_p2p(struct mwifiex_private *priv)
 {
         u16 mode = P2P_MODE_DISABLE;
 
-        if (GET_BSS_ROLE(priv) != MWIFIEX_BSS_ROLE_STA)
-                mwifiex_set_bss_role(priv, MWIFIEX_BSS_ROLE_STA);
-
         if (mwifiex_send_cmd(priv, HostCmd_CMD_P2P_MODE_CFG,
                              HostCmd_ACT_GEN_SET, 0, &mode, true))
                 return -1;
@@ -730,12 +712,249 @@ mwifiex_cfg80211_init_p2p_go(struct mwifiex_private *priv)
                              HostCmd_ACT_GEN_SET, 0, &mode, true))
                 return -1;
 
-        if (GET_BSS_ROLE(priv) != MWIFIEX_BSS_ROLE_UAP)
-                mwifiex_set_bss_role(priv, MWIFIEX_BSS_ROLE_UAP);
+        return 0;
+}
+
+static int mwifiex_deinit_priv_params(struct mwifiex_private *priv)
+{
+        priv->mgmt_frame_mask = 0;
+        if (mwifiex_send_cmd(priv, HostCmd_CMD_MGMT_FRAME_REG,
+                             HostCmd_ACT_GEN_SET, 0,
+                             &priv->mgmt_frame_mask, false)) {
+                dev_warn(priv->adapter->dev,
+                         "could not unregister mgmt frame rx\n");
+                return -1;
+        }
+
+        mwifiex_deauthenticate(priv, NULL);
+        mwifiex_free_priv(priv);
+        priv->wdev.iftype = NL80211_IFTYPE_UNSPECIFIED;
+        priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
+        priv->sec_info.authentication_mode = NL80211_AUTHTYPE_OPEN_SYSTEM;
+
+        return 0;
+}
+
+static int
+mwifiex_init_new_priv_params(struct mwifiex_private *priv,
+                             struct net_device *dev,
+                             enum nl80211_iftype type)
+{
+        mwifiex_init_priv(priv);
+
+        priv->bss_mode = type;
+        priv->wdev.iftype = type;
+
+        mwifiex_init_priv_params(priv, priv->netdev);
+        priv->bss_started = 0;
+
+        switch (type) {
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_ADHOC:
+                priv->bss_role =  MWIFIEX_BSS_ROLE_STA;
+                priv->bss_type = MWIFIEX_BSS_TYPE_STA;
+                break;
+        case NL80211_IFTYPE_P2P_CLIENT:
+        case NL80211_IFTYPE_P2P_GO:
+                priv->bss_role =  MWIFIEX_BSS_ROLE_STA;
+                priv->bss_type = MWIFIEX_BSS_TYPE_P2P;
+                break;
+        case NL80211_IFTYPE_AP:
+                priv->bss_type = MWIFIEX_BSS_TYPE_UAP;
+                priv->bss_role = MWIFIEX_BSS_ROLE_UAP;
+                break;
+        default:
+                dev_err(priv->adapter->dev,
+                        "%s: changing to %d not supported\n",
+                        dev->name, type);
+                return -EOPNOTSUPP;
+        }
 
         return 0;
 }
 
+static int
+mwifiex_change_vif_to_p2p(struct net_device *dev,
+                          enum nl80211_iftype curr_iftype,
+                          enum nl80211_iftype type, u32 *flags,
+                          struct vif_params *params)
+{
+        struct mwifiex_private *priv;
+        struct mwifiex_adapter *adapter;
+
+        priv = mwifiex_netdev_get_priv(dev);
+
+        if (!priv)
+                return -1;
+
+        adapter = priv->adapter;
+
+        if (adapter->curr_iface_comb.p2p_intf ==
+            adapter->iface_limit.p2p_intf) {
+                dev_err(adapter->dev,
+                        "cannot create multiple P2P ifaces\n");
+                return -1;
+        }
+
+        dev_dbg(priv->adapter->dev, "%s: changing role to p2p\n", dev->name);
+
+        if (mwifiex_deinit_priv_params(priv))
+                return -1;
+        if (mwifiex_init_new_priv_params(priv, dev, type))
+                return -1;
+
+        switch (type) {
+        case NL80211_IFTYPE_P2P_CLIENT:
+                if (mwifiex_cfg80211_init_p2p_client(priv))
+                        return -EFAULT;
+                break;
+        case NL80211_IFTYPE_P2P_GO:
+                if (mwifiex_cfg80211_init_p2p_go(priv))
+                        return -EFAULT;
+                break;
+        default:
+                dev_err(priv->adapter->dev,
+                        "%s: changing to %d not supported\n",
+                        dev->name, type);
+                return -EOPNOTSUPP;
+        }
+
+        if (mwifiex_send_cmd(priv, HostCmd_CMD_SET_BSS_MODE,
+                             HostCmd_ACT_GEN_SET, 0, NULL, true))
+                return -1;
+
+        if (mwifiex_sta_init_cmd(priv, false, false))
+                return -1;
+
+        switch (curr_iftype) {
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_ADHOC:
+                adapter->curr_iface_comb.sta_intf--;
+                break;
+        case NL80211_IFTYPE_AP:
+                adapter->curr_iface_comb.uap_intf--;
+                break;
+        default:
+                break;
+        }
+
+        adapter->curr_iface_comb.p2p_intf++;
+        dev->ieee80211_ptr->iftype = type;
+
+        return 0;
+}
+
+static int
+mwifiex_change_vif_to_sta_adhoc(struct net_device *dev,
+                                enum nl80211_iftype curr_iftype,
+                                enum nl80211_iftype type, u32 *flags,
+                                struct vif_params *params)
+{
+        struct mwifiex_private *priv;
+        struct mwifiex_adapter *adapter;
+
+        priv = mwifiex_netdev_get_priv(dev);
+
+        if (!priv)
+                return -1;
+
+        adapter = priv->adapter;
+
+        if ((curr_iftype != NL80211_IFTYPE_P2P_CLIENT &&
+             curr_iftype != NL80211_IFTYPE_P2P_GO) &&
+            (adapter->curr_iface_comb.sta_intf ==
+             adapter->iface_limit.sta_intf)) {
+                dev_err(adapter->dev,
+                        "cannot create multiple station/adhoc ifaces\n");
+                return -1;
+        }
+
+        if (type == NL80211_IFTYPE_STATION)
+                dev_notice(adapter->dev,
+                           "%s: changing role to station\n", dev->name);
+        else
+                dev_notice(adapter->dev,
+                           "%s: changing role to adhoc\n", dev->name);
+
+        if (mwifiex_deinit_priv_params(priv))
+                return -1;
+        if (mwifiex_init_new_priv_params(priv, dev, type))
+                return -1;
+        if (mwifiex_send_cmd(priv, HostCmd_CMD_SET_BSS_MODE,
+                             HostCmd_ACT_GEN_SET, 0, NULL, true))
+                return -1;
+        if (mwifiex_sta_init_cmd(priv, false, false))
+                return -1;
+
+        switch (curr_iftype) {
+        case NL80211_IFTYPE_P2P_CLIENT:
+        case NL80211_IFTYPE_P2P_GO:
+                adapter->curr_iface_comb.p2p_intf--;
+                break;
+        case NL80211_IFTYPE_AP:
+                adapter->curr_iface_comb.uap_intf--;
+                break;
+        default:
+                break;
+        }
+
+        adapter->curr_iface_comb.sta_intf++;
+        dev->ieee80211_ptr->iftype = type;
+        return 0;
+}
+
+static int
+mwifiex_change_vif_to_ap(struct net_device *dev,
+                         enum nl80211_iftype curr_iftype,
+                         enum nl80211_iftype type, u32 *flags,
+                         struct vif_params *params)
+{
+        struct mwifiex_private *priv;
+        struct mwifiex_adapter *adapter;
+
+        priv = mwifiex_netdev_get_priv(dev);
+
+        if (!priv)
+                return -1;
+
+        adapter = priv->adapter;
+
+        if (adapter->curr_iface_comb.uap_intf ==
+            adapter->iface_limit.uap_intf) {
+                dev_err(adapter->dev,
+                        "cannot create multiple AP ifaces\n");
+                return -1;
+        }
+
+        dev_notice(adapter->dev, "%s: changing role to AP\n", dev->name);
+
+        if (mwifiex_deinit_priv_params(priv))
+                return -1;
+        if (mwifiex_init_new_priv_params(priv, dev, type))
+                return -1;
+        if (mwifiex_send_cmd(priv, HostCmd_CMD_SET_BSS_MODE,
+                             HostCmd_ACT_GEN_SET, 0, NULL, true))
+                return -1;
+        if (mwifiex_sta_init_cmd(priv, false, false))
+                return -1;
+
+        switch (curr_iftype) {
+        case NL80211_IFTYPE_P2P_CLIENT:
+        case NL80211_IFTYPE_P2P_GO:
+                adapter->curr_iface_comb.p2p_intf--;
+                break;
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_ADHOC:
+                adapter->curr_iface_comb.sta_intf--;
+                break;
+        default:
+                break;
+        }
+
+        adapter->curr_iface_comb.uap_intf++;
+        dev->ieee80211_ptr->iftype = type;
+        return 0;
+}
 /*
  * CFG802.11 operation handler to change interface type.
  */
@@ -745,19 +964,32 @@ mwifiex_cfg80211_change_virtual_intf(struct wiphy *wiphy,
                                      enum nl80211_iftype type, u32 *flags,
                                      struct vif_params *params)
 {
-        int ret;
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
+        enum nl80211_iftype curr_iftype = dev->ieee80211_ptr->iftype;
 
-        switch (dev->ieee80211_ptr->iftype) {
+        switch (curr_iftype) {
         case NL80211_IFTYPE_ADHOC:
                 switch (type) {
                 case NL80211_IFTYPE_STATION:
-                        break;
+                        priv->bss_mode = type;
+                        priv->sec_info.authentication_mode =
+                                                   NL80211_AUTHTYPE_OPEN_SYSTEM;
+                        dev->ieee80211_ptr->iftype = type;
+                        mwifiex_deauthenticate(priv, NULL);
+                        return mwifiex_send_cmd(priv, HostCmd_CMD_SET_BSS_MODE,
+                                                HostCmd_ACT_GEN_SET, 0, NULL,
+                                                true);
+                case NL80211_IFTYPE_P2P_CLIENT:
+                case NL80211_IFTYPE_P2P_GO:
+                        return mwifiex_change_vif_to_p2p(dev, curr_iftype,
+                                                         type, flags, params);
+                case NL80211_IFTYPE_AP:
+                        return mwifiex_change_vif_to_ap(dev, curr_iftype, type,
+                                                        flags, params);
                 case NL80211_IFTYPE_UNSPECIFIED:
                         wiphy_warn(wiphy, "%s: kept type as IBSS\n", dev->name);
                 case NL80211_IFTYPE_ADHOC:      /* This shouldn't happen */
                         return 0;
-                case NL80211_IFTYPE_AP:
                 default:
                         wiphy_err(wiphy, "%s: changing to %d not supported\n",
                                   dev->name, type);
@@ -767,22 +999,25 @@ mwifiex_cfg80211_change_virtual_intf(struct wiphy *wiphy,
         case NL80211_IFTYPE_STATION:
                 switch (type) {
                 case NL80211_IFTYPE_ADHOC:
-                        break;
-                case NL80211_IFTYPE_P2P_CLIENT:
-                        if (mwifiex_cfg80211_init_p2p_client(priv))
-                                return -EFAULT;
+                        priv->bss_mode = type;
+                        priv->sec_info.authentication_mode =
+                                                   NL80211_AUTHTYPE_OPEN_SYSTEM;
                         dev->ieee80211_ptr->iftype = type;
-                        return 0;
+                        mwifiex_deauthenticate(priv, NULL);
+                        return mwifiex_send_cmd(priv, HostCmd_CMD_SET_BSS_MODE,
+                                                HostCmd_ACT_GEN_SET, 0, NULL,
+                                                true);
+                case NL80211_IFTYPE_P2P_CLIENT:
                 case NL80211_IFTYPE_P2P_GO:
-                        if (mwifiex_cfg80211_init_p2p_go(priv))
-                                return -EFAULT;
-                        dev->ieee80211_ptr->iftype = type;
-                        return 0;
+                        return mwifiex_change_vif_to_p2p(dev, curr_iftype,
+                                                         type, flags, params);
+                case NL80211_IFTYPE_AP:
+                        return mwifiex_change_vif_to_ap(dev, curr_iftype, type,
+                                                        flags, params);
                 case NL80211_IFTYPE_UNSPECIFIED:
                         wiphy_warn(wiphy, "%s: kept type as STA\n", dev->name);
                 case NL80211_IFTYPE_STATION:    /* This shouldn't happen */
                         return 0;
-                case NL80211_IFTYPE_AP:
                 default:
                         wiphy_err(wiphy, "%s: changing to %d not supported\n",
                                   dev->name, type);
@@ -791,12 +1026,20 @@ mwifiex_cfg80211_change_virtual_intf(struct wiphy *wiphy,
                 break;
         case NL80211_IFTYPE_AP:
                 switch (type) {
+                case NL80211_IFTYPE_ADHOC:
+                case NL80211_IFTYPE_STATION:
+                        return mwifiex_change_vif_to_sta_adhoc(dev, curr_iftype,
+                                                               type, flags,
+                                                               params);
+                        break;
+                case NL80211_IFTYPE_P2P_CLIENT:
+                case NL80211_IFTYPE_P2P_GO:
+                        return mwifiex_change_vif_to_p2p(dev, curr_iftype,
+                                                         type, flags, params);
                 case NL80211_IFTYPE_UNSPECIFIED:
                         wiphy_warn(wiphy, "%s: kept type as AP\n", dev->name);
                 case NL80211_IFTYPE_AP:         /* This shouldn't happen */
                         return 0;
-                case NL80211_IFTYPE_ADHOC:
-                case NL80211_IFTYPE_STATION:
                 default:
                         wiphy_err(wiphy, "%s: changing to %d not supported\n",
                                   dev->name, type);
@@ -807,11 +1050,30 @@ mwifiex_cfg80211_change_virtual_intf(struct wiphy *wiphy,
         case NL80211_IFTYPE_P2P_GO:
                 switch (type) {
                 case NL80211_IFTYPE_STATION:
-                        if (mwifiex_cfg80211_deinit_p2p(priv))
+                        if (mwifiex_cfg80211_init_p2p_client(priv))
                                 return -EFAULT;
                         dev->ieee80211_ptr->iftype = type;
+                        break;
+                case NL80211_IFTYPE_ADHOC:
+                        if (mwifiex_cfg80211_deinit_p2p(priv))
+                                return -EFAULT;
+                        return mwifiex_change_vif_to_sta_adhoc(dev, curr_iftype,
+                                                               type, flags,
+                                                               params);
+                        break;
+                case NL80211_IFTYPE_AP:
+                        if (mwifiex_cfg80211_deinit_p2p(priv))
+                                return -EFAULT;
+                        return mwifiex_change_vif_to_ap(dev, curr_iftype, type,
+                                                        flags, params);
+                case NL80211_IFTYPE_UNSPECIFIED:
+                        wiphy_warn(wiphy, "%s: kept type as P2P\n", dev->name);
+                case NL80211_IFTYPE_P2P_CLIENT:
+                case NL80211_IFTYPE_P2P_GO:
                         return 0;
                 default:
+                        wiphy_err(wiphy, "%s: changing to %d not supported\n",
+                                  dev->name, type);
                         return -EOPNOTSUPP;
                 }
                 break;
@@ -821,16 +1083,8 @@ mwifiex_cfg80211_change_virtual_intf(struct wiphy *wiphy,
                 return -EOPNOTSUPP;
         }
 
-        dev->ieee80211_ptr->iftype = type;
-        priv->bss_mode = type;
-        mwifiex_deauthenticate(priv, NULL);
-
-        priv->sec_info.authentication_mode = NL80211_AUTHTYPE_OPEN_SYSTEM;
-
-        ret = mwifiex_send_cmd(priv, HostCmd_CMD_SET_BSS_MODE,
-                               HostCmd_ACT_GEN_SET, 0, NULL, true);
 
-        return ret;
+        return 0;
 }
 
 static void
@@ -856,16 +1110,16 @@ mwifiex_parse_htinfo(struct mwifiex_private *priv, u8 tx_htinfo,
                         /* HT or VHT */
                         switch (tx_htinfo & (BIT(3) | BIT(2))) {
                         case 0:
-                                /* This will be 20MHz */
+                                rate->bw = RATE_INFO_BW_20;
                                 break;
                         case (BIT(2)):
-                                rate->flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
+                                rate->bw = RATE_INFO_BW_40;
                                 break;
                         case (BIT(3)):
-                                rate->flags |= RATE_INFO_FLAGS_80_MHZ_WIDTH;
+                                rate->bw = RATE_INFO_BW_80;
                                 break;
                         case (BIT(3) | BIT(2)):
-                                rate->flags |= RATE_INFO_FLAGS_160_MHZ_WIDTH;
+                                rate->bw = RATE_INFO_BW_160;
                                 break;
                         }
 
@@ -885,8 +1139,9 @@ mwifiex_parse_htinfo(struct mwifiex_private *priv, u8 tx_htinfo,
                 if ((tx_htinfo & BIT(0)) && (priv->tx_rate < 16)) {
                         rate->mcs = priv->tx_rate;
                         rate->flags |= RATE_INFO_FLAGS_MCS;
+                        rate->bw = RATE_INFO_BW_20;
                         if (tx_htinfo & BIT(1))
-                                rate->flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
+                                rate->bw = RATE_INFO_BW_40;
                         if (tx_htinfo & BIT(2))
                                 rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
                 }
@@ -910,10 +1165,10 @@ mwifiex_dump_station_info(struct mwifiex_private *priv,
 {
         u32 rate;
 
-        sinfo->filled = STATION_INFO_RX_BYTES | STATION_INFO_TX_BYTES |
-                        STATION_INFO_RX_PACKETS | STATION_INFO_TX_PACKETS |
-                        STATION_INFO_TX_BITRATE |
-                        STATION_INFO_SIGNAL | STATION_INFO_SIGNAL_AVG;
+        sinfo->filled = BIT(NL80211_STA_INFO_RX_BYTES) | BIT(NL80211_STA_INFO_TX_BYTES) |
+                        BIT(NL80211_STA_INFO_RX_PACKETS) | BIT(NL80211_STA_INFO_TX_PACKETS) |
+                        BIT(NL80211_STA_INFO_TX_BITRATE) |
+                        BIT(NL80211_STA_INFO_SIGNAL) | BIT(NL80211_STA_INFO_SIGNAL_AVG);
 
         /* Get signal information from the firmware */
         if (mwifiex_send_cmd(priv, HostCmd_CMD_RSSI_INFO,
@@ -944,7 +1199,7 @@ mwifiex_dump_station_info(struct mwifiex_private *priv,
         sinfo->txrate.legacy = rate * 5;
 
         if (priv->bss_mode == NL80211_IFTYPE_STATION) {
-                sinfo->filled |= STATION_INFO_BSS_PARAM;
+                sinfo->filled |= BIT(NL80211_STA_INFO_BSS_PARAM);
                 sinfo->bss_param.flags = 0;
                 if (priv->curr_bss_params.bss_descriptor.cap_info_bitmap &
                                                 WLAN_CAPABILITY_SHORT_PREAMBLE)
@@ -1037,10 +1292,11 @@ mwifiex_cfg80211_dump_survey(struct wiphy *wiphy, struct net_device *dev,
         survey->channel = ieee80211_get_channel(wiphy,
             ieee80211_channel_to_frequency(pchan_stats[idx].chan_num, band));
         survey->filled = SURVEY_INFO_NOISE_DBM |
-                SURVEY_INFO_CHANNEL_TIME | SURVEY_INFO_CHANNEL_TIME_BUSY;
+                         SURVEY_INFO_TIME |
+                         SURVEY_INFO_TIME_BUSY;
         survey->noise = pchan_stats[idx].noise;
-        survey->channel_time = pchan_stats[idx].cca_scan_dur;
-        survey->channel_time_busy = pchan_stats[idx].cca_busy_dur;
+        survey->time = pchan_stats[idx].cca_scan_dur;
+        survey->time_busy = pchan_stats[idx].cca_busy_dur;
 
         return 0;
 }
@@ -1395,10 +1651,13 @@ static int mwifiex_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
 {
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
 
+        mwifiex_abort_cac(priv);
+
         if (mwifiex_del_mgmt_ies(priv))
                 wiphy_err(wiphy, "Failed to delete mgmt IEs!\n");
 
         priv->ap_11n_enabled = 0;
+        memset(&priv->bss_cfg, 0, sizeof(priv->bss_cfg));
 
         if (mwifiex_send_cmd(priv, HostCmd_CMD_UAP_BSS_STOP,
                              HostCmd_ACT_GEN_SET, 0, NULL, true)) {
@@ -1420,12 +1679,9 @@ static int mwifiex_cfg80211_start_ap(struct wiphy *wiphy,
 {
         struct mwifiex_uap_bss_param *bss_cfg;
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
-        u8 config_bands = 0;
 
         if (GET_BSS_ROLE(priv) != MWIFIEX_BSS_ROLE_UAP)
                 return -1;
-        if (mwifiex_set_mgmt_ies(priv, &params->beacon))
-                return -1;
 
         bss_cfg = kzalloc(sizeof(struct mwifiex_uap_bss_param), GFP_KERNEL);
         if (!bss_cfg)
@@ -1442,6 +1698,11 @@ static int mwifiex_cfg80211_start_ap(struct wiphy *wiphy,
                 memcpy(bss_cfg->ssid.ssid, params->ssid, params->ssid_len);
                 bss_cfg->ssid.ssid_len = params->ssid_len;
         }
+        if (params->inactivity_timeout > 0) {
+                /* sta_ao_timer/ps_sta_ao_timer is in unit of 100ms */
+                bss_cfg->sta_ao_timer = 10 * params->inactivity_timeout;
+                bss_cfg->ps_sta_ao_timer = 10 * params->inactivity_timeout;
+        }
 
         switch (params->hidden_ssid) {
         case NL80211_HIDDEN_SSID_NOT_IN_USE:
@@ -1457,33 +1718,8 @@ static int mwifiex_cfg80211_start_ap(struct wiphy *wiphy,
                 return -EINVAL;
         }
 
-        bss_cfg->channel = ieee80211_frequency_to_channel(
-                                params->chandef.chan->center_freq);
-
-        /* Set appropriate bands */
-        if (params->chandef.chan->band == IEEE80211_BAND_2GHZ) {
-                bss_cfg->band_cfg = BAND_CONFIG_BG;
-                config_bands = BAND_B | BAND_G;
-
-                if (params->chandef.width > NL80211_CHAN_WIDTH_20_NOHT)
-                        config_bands |= BAND_GN;
-        } else {
-                bss_cfg->band_cfg = BAND_CONFIG_A;
-                config_bands = BAND_A;
-
-                if (params->chandef.width > NL80211_CHAN_WIDTH_20_NOHT)
-                        config_bands |= BAND_AN;
-
-                if (params->chandef.width > NL80211_CHAN_WIDTH_40)
-                        config_bands |= BAND_AAC;
-        }
-
-        if (!((config_bands | priv->adapter->fw_bands) &
-              ~priv->adapter->fw_bands))
-                priv->adapter->config_bands = config_bands;
-
+        mwifiex_uap_set_channel(bss_cfg, params->chandef);
         mwifiex_set_uap_rates(bss_cfg, params);
-        mwifiex_send_domain_info_cmd_fw(wiphy);
 
         if (mwifiex_set_secure_params(priv, bss_cfg, params)) {
                 kfree(bss_cfg);
@@ -1506,45 +1742,29 @@ static int mwifiex_cfg80211_start_ap(struct wiphy *wiphy,
 
         mwifiex_set_wmm_params(priv, bss_cfg, params);
 
-        if (params->inactivity_timeout > 0) {
-                /* sta_ao_timer/ps_sta_ao_timer is in unit of 100ms */
-                bss_cfg->sta_ao_timer = 10 * params->inactivity_timeout;
-                bss_cfg->ps_sta_ao_timer = 10 * params->inactivity_timeout;
+        if (mwifiex_is_11h_active(priv) &&
+            !cfg80211_chandef_dfs_required(wiphy, &params->chandef,
+                                           priv->bss_mode)) {
+                dev_dbg(priv->adapter->dev, "Disable 11h extensions in FW\n");
+                if (mwifiex_11h_activate(priv, false)) {
+                        dev_err(priv->adapter->dev,
+                                "Failed to disable 11h extensions!!");
+                        return -1;
+                }
+                priv->state_11h.is_11h_active = true;
         }
 
-        if (mwifiex_send_cmd(priv, HostCmd_CMD_UAP_BSS_STOP,
-                             HostCmd_ACT_GEN_SET, 0, NULL, true)) {
-                wiphy_err(wiphy, "Failed to stop the BSS\n");
+        if (mwifiex_config_start_uap(priv, bss_cfg)) {
+                wiphy_err(wiphy, "Failed to start AP\n");
                 kfree(bss_cfg);
                 return -1;
         }
 
-        if (mwifiex_send_cmd(priv, HostCmd_CMD_UAP_SYS_CONFIG,
-                             HostCmd_ACT_GEN_SET,
-                             UAP_BSS_PARAMS_I, bss_cfg, false)) {
-                wiphy_err(wiphy, "Failed to set the SSID\n");
-                kfree(bss_cfg);
+        if (mwifiex_set_mgmt_ies(priv, &params->beacon))
                 return -1;
-        }
 
+        memcpy(&priv->bss_cfg, bss_cfg, sizeof(priv->bss_cfg));
         kfree(bss_cfg);
-
-        if (mwifiex_send_cmd(priv, HostCmd_CMD_UAP_BSS_START,
-                             HostCmd_ACT_GEN_SET, 0, NULL, false)) {
-                wiphy_err(wiphy, "Failed to start the BSS\n");
-                return -1;
-        }
-
-        if (priv->sec_info.wep_enabled)
-                priv->curr_pkt_filter |= HostCmd_ACT_MAC_WEP_ENABLE;
-        else
-                priv->curr_pkt_filter &= ~HostCmd_ACT_MAC_WEP_ENABLE;
-
-        if (mwifiex_send_cmd(priv, HostCmd_CMD_MAC_CONTROL,
-                             HostCmd_ACT_GEN_SET, 0,
-                             &priv->curr_pkt_filter, true))
-                return -1;
-
         return 0;
 }
 
@@ -1603,15 +1823,15 @@ static int mwifiex_cfg80211_inform_ibss_bss(struct mwifiex_private *priv)
         ie_len = ie_buf[1] + sizeof(struct ieee_types_header);
 
         band = mwifiex_band_to_radio_type(priv->curr_bss_params.band);
-        chan = __ieee80211_get_channel(priv->wdev->wiphy,
+        chan = __ieee80211_get_channel(priv->wdev.wiphy,
                         ieee80211_channel_to_frequency(bss_info.bss_chan,
                                                        band));
 
-        bss = cfg80211_inform_bss(priv->wdev->wiphy, chan,
+        bss = cfg80211_inform_bss(priv->wdev.wiphy, chan,
                                   CFG80211_BSS_FTYPE_UNKNOWN,
                                   bss_info.bssid, 0, WLAN_CAPABILITY_IBSS,
                                   0, ie_buf, ie_len, 0, GFP_KERNEL);
-        cfg80211_put_bss(priv->wdev->wiphy, bss);
+        cfg80211_put_bss(priv->wdev.wiphy, bss);
         memcpy(priv->cfg_bssid, bss_info.bssid, ETH_ALEN);
 
         return 0;
@@ -1732,12 +1952,12 @@ done:
 
                 /* Find the BSS we want using available scan results */
                 if (mode == NL80211_IFTYPE_ADHOC)
-                        bss = cfg80211_get_bss(priv->wdev->wiphy, channel,
+                        bss = cfg80211_get_bss(priv->wdev.wiphy, channel,
                                                bssid, ssid, ssid_len,
                                                WLAN_CAPABILITY_IBSS,
                                                WLAN_CAPABILITY_IBSS);
                 else
-                        bss = cfg80211_get_bss(priv->wdev->wiphy, channel,
+                        bss = cfg80211_get_bss(priv->wdev.wiphy, channel,
                                                bssid, ssid, ssid_len,
                                                WLAN_CAPABILITY_ESS,
                                                WLAN_CAPABILITY_ESS);
@@ -1784,6 +2004,7 @@ mwifiex_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
                          struct cfg80211_connect_params *sme)
 {
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
+        struct mwifiex_adapter *adapter = priv->adapter;
         int ret;
 
         if (GET_BSS_ROLE(priv) != MWIFIEX_BSS_ROLE_STA) {
@@ -1793,11 +2014,18 @@ mwifiex_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
                 return -EINVAL;
         }
 
-        if (priv->wdev && priv->wdev->current_bss) {
+        if (priv->wdev.current_bss) {
                 wiphy_warn(wiphy, "%s: already connected\n", dev->name);
                 return -EALREADY;
         }
 
+        if (adapter->surprise_removed || adapter->is_cmd_timedout) {
+                wiphy_err(wiphy,
+                          "%s: Ignore connection. Card removed or FW in bad state\n",
+                          dev->name);
+                return -EFAULT;
+        }
+
         wiphy_dbg(wiphy, "info: Trying to associate to %s and bssid %pM\n",
                   (char *) sme->ssid, sme->bssid);
 
@@ -1844,7 +2072,7 @@ mwifiex_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
 static int mwifiex_set_ibss_params(struct mwifiex_private *priv,
                                    struct cfg80211_ibss_params *params)
 {
-        struct wiphy *wiphy = priv->wdev->wiphy;
+        struct wiphy *wiphy = priv->wdev.wiphy;
         struct mwifiex_adapter *adapter = priv->adapter;
         int index = 0, i;
         u8 config_bands = 0;
@@ -2169,6 +2397,7 @@ mwifiex_setup_ht_caps(struct ieee80211_sta_ht_cap *ht_info,
         ht_info->mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
 }
 
+#define MWIFIEX_MAX_WQ_LEN  30
 /*
  *  create a new virtual interface with the given name
  */
@@ -2182,7 +2411,7 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
         struct mwifiex_private *priv;
         struct net_device *dev;
         void *mdev_priv;
-        struct wireless_dev *wdev;
+        char dfs_cac_str[MWIFIEX_MAX_WQ_LEN], dfs_chsw_str[MWIFIEX_MAX_WQ_LEN];
 
         if (!adapter)
                 return ERR_PTR(-EFAULT);
@@ -2191,20 +2420,22 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
         case NL80211_IFTYPE_UNSPECIFIED:
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_ADHOC:
-                priv = adapter->priv[MWIFIEX_BSS_TYPE_STA];
-                if (priv->bss_mode) {
+                if (adapter->curr_iface_comb.sta_intf ==
+                    adapter->iface_limit.sta_intf) {
                         wiphy_err(wiphy,
                                   "cannot create multiple sta/adhoc ifaces\n");
                         return ERR_PTR(-EINVAL);
                 }
 
-                wdev = kzalloc(sizeof(struct wireless_dev), GFP_KERNEL);
-                if (!wdev)
-                        return ERR_PTR(-ENOMEM);
+                priv = mwifiex_get_unused_priv(adapter);
+                if (!priv) {
+                        wiphy_err(wiphy,
+                                  "could not get free private struct\n");
+                        return ERR_PTR(-EFAULT);
+                }
 
-                wdev->wiphy = wiphy;
-                priv->wdev = wdev;
-                wdev->iftype = NL80211_IFTYPE_STATION;
+                priv->wdev.wiphy = wiphy;
+                priv->wdev.iftype = NL80211_IFTYPE_STATION;
 
                 if (type == NL80211_IFTYPE_UNSPECIFIED)
                         priv->bss_mode = NL80211_IFTYPE_STATION;
@@ -2219,20 +2450,22 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
 
                 break;
         case NL80211_IFTYPE_AP:
-                priv = adapter->priv[MWIFIEX_BSS_TYPE_UAP];
-
-                if (priv->bss_mode) {
-                        wiphy_err(wiphy, "Can't create multiple AP interfaces");
+                if (adapter->curr_iface_comb.uap_intf ==
+                    adapter->iface_limit.uap_intf) {
+                        wiphy_err(wiphy,
+                                  "cannot create multiple AP ifaces\n");
                         return ERR_PTR(-EINVAL);
                 }
 
-                wdev = kzalloc(sizeof(struct wireless_dev), GFP_KERNEL);
-                if (!wdev)
-                        return ERR_PTR(-ENOMEM);
+                priv = mwifiex_get_unused_priv(adapter);
+                if (!priv) {
+                        wiphy_err(wiphy,
+                                  "could not get free private struct\n");
+                        return ERR_PTR(-EFAULT);
+                }
 
-                priv->wdev = wdev;
-                wdev->wiphy = wiphy;
-                wdev->iftype = NL80211_IFTYPE_AP;
+                priv->wdev.wiphy = wiphy;
+                priv->wdev.iftype = NL80211_IFTYPE_AP;
 
                 priv->bss_type = MWIFIEX_BSS_TYPE_UAP;
                 priv->frame_type = MWIFIEX_DATA_FRAME_TYPE_ETH_II;
@@ -2244,24 +2477,25 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
 
                 break;
         case NL80211_IFTYPE_P2P_CLIENT:
-                priv = adapter->priv[MWIFIEX_BSS_TYPE_P2P];
-
-                if (priv->bss_mode) {
-                        wiphy_err(wiphy, "Can't create multiple P2P ifaces");
+                if (adapter->curr_iface_comb.p2p_intf ==
+                    adapter->iface_limit.p2p_intf) {
+                        wiphy_err(wiphy,
+                                  "cannot create multiple P2P ifaces\n");
                         return ERR_PTR(-EINVAL);
                 }
 
-                wdev = kzalloc(sizeof(struct wireless_dev), GFP_KERNEL);
-                if (!wdev)
-                        return ERR_PTR(-ENOMEM);
-
-                priv->wdev = wdev;
-                wdev->wiphy = wiphy;
+                priv = mwifiex_get_unused_priv(adapter);
+                if (!priv) {
+                        wiphy_err(wiphy,
+                                  "could not get free private struct\n");
+                        return ERR_PTR(-EFAULT);
+                }
 
+                priv->wdev.wiphy = wiphy;
                 /* At start-up, wpa_supplicant tries to change the interface
                  * to NL80211_IFTYPE_STATION if it is not managed mode.
                  */
-                wdev->iftype = NL80211_IFTYPE_P2P_CLIENT;
+                priv->wdev.iftype = NL80211_IFTYPE_P2P_CLIENT;
                 priv->bss_mode = NL80211_IFTYPE_P2P_CLIENT;
 
                 /* Setting bss_type to P2P tells firmware that this interface
@@ -2277,8 +2511,9 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
                 priv->bss_num = 0;
 
                 if (mwifiex_cfg80211_init_p2p_client(priv)) {
-                        wdev = ERR_PTR(-EFAULT);
-                        goto done;
+                        memset(&priv->wdev, 0, sizeof(priv->wdev));
+                        priv->wdev.iftype = NL80211_IFTYPE_UNSPECIFIED;
+                        return ERR_PTR(-EFAULT);
                 }
 
                 break;
@@ -2292,9 +2527,10 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
                                IEEE80211_NUM_ACS, 1);
         if (!dev) {
                 wiphy_err(wiphy, "no memory available for netdevice\n");
+                memset(&priv->wdev, 0, sizeof(priv->wdev));
+                priv->wdev.iftype = NL80211_IFTYPE_UNSPECIFIED;
                 priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
-                wdev = ERR_PTR(-ENOMEM);
-                goto done;
+                return ERR_PTR(-ENOMEM);
         }
 
         mwifiex_init_priv_params(priv, dev);
@@ -2314,7 +2550,7 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
                         &wiphy->bands[IEEE80211_BAND_5GHZ]->vht_cap, priv);
 
         dev_net_set(dev, wiphy_net(wiphy));
-        dev->ieee80211_ptr = priv->wdev;
+        dev->ieee80211_ptr = &priv->wdev;
         dev->ieee80211_ptr->iftype = priv->bss_mode;
         memcpy(dev->dev_addr, wiphy->perm_addr, ETH_ALEN);
         SET_NETDEV_DEV(dev, wiphy_dev(wiphy));
@@ -2335,10 +2571,47 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
                 free_netdev(dev);
                 priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
                 priv->netdev = NULL;
-                wdev = ERR_PTR(-EFAULT);
-                goto done;
+                memset(&priv->wdev, 0, sizeof(priv->wdev));
+                priv->wdev.iftype = NL80211_IFTYPE_UNSPECIFIED;
+                return ERR_PTR(-EFAULT);
+        }
+
+        strcpy(dfs_cac_str, "MWIFIEX_DFS_CAC");
+        strcat(dfs_cac_str, name);
+        priv->dfs_cac_workqueue = alloc_workqueue(dfs_cac_str,
+                                                  WQ_HIGHPRI |
+                                                  WQ_MEM_RECLAIM |
+                                                  WQ_UNBOUND, 1);
+        if (!priv->dfs_cac_workqueue) {
+                wiphy_err(wiphy, "cannot register virtual network device\n");
+                free_netdev(dev);
+                priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
+                priv->netdev = NULL;
+                memset(&priv->wdev, 0, sizeof(priv->wdev));
+                priv->wdev.iftype = NL80211_IFTYPE_UNSPECIFIED;
+                return ERR_PTR(-ENOMEM);
         }
 
+        INIT_DELAYED_WORK(&priv->dfs_cac_work, mwifiex_dfs_cac_work_queue);
+
+        strcpy(dfs_chsw_str, "MWIFIEX_DFS_CHSW");
+        strcat(dfs_chsw_str, name);
+        priv->dfs_chan_sw_workqueue = alloc_workqueue(dfs_chsw_str,
+                                                      WQ_HIGHPRI | WQ_UNBOUND |
+                                                      WQ_MEM_RECLAIM, 1);
+        if (!priv->dfs_chan_sw_workqueue) {
+                wiphy_err(wiphy, "cannot register virtual network device\n");
+                free_netdev(dev);
+                priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
+                priv->netdev = NULL;
+                memset(&priv->wdev, 0, sizeof(priv->wdev));
+                priv->wdev.iftype = NL80211_IFTYPE_UNSPECIFIED;
+                return ERR_PTR(-ENOMEM);
+        }
+
+        INIT_DELAYED_WORK(&priv->dfs_chan_sw_work,
+                          mwifiex_dfs_chan_sw_work_queue);
+
         sema_init(&priv->async_sem, 1);
 
         dev_dbg(adapter->dev, "info: %s: Marvell 802.11 Adapter\n", dev->name);
@@ -2347,13 +2620,24 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
         mwifiex_dev_debugfs_init(priv);
 #endif
 
-done:
-        if (IS_ERR(wdev)) {
-                kfree(priv->wdev);
-                priv->wdev = NULL;
+        switch (type) {
+        case NL80211_IFTYPE_UNSPECIFIED:
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_ADHOC:
+                adapter->curr_iface_comb.sta_intf++;
+                break;
+        case NL80211_IFTYPE_AP:
+                adapter->curr_iface_comb.uap_intf++;
+                break;
+        case NL80211_IFTYPE_P2P_CLIENT:
+                adapter->curr_iface_comb.p2p_intf++;
+                break;
+        default:
+                wiphy_err(wiphy, "type not supported\n");
+                return ERR_PTR(-EINVAL);
         }
 
-        return wdev;
+        return &priv->wdev;
 }
 EXPORT_SYMBOL_GPL(mwifiex_add_virtual_intf);
 
@@ -2363,12 +2647,13 @@ EXPORT_SYMBOL_GPL(mwifiex_add_virtual_intf);
 int mwifiex_del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev)
 {
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(wdev->netdev);
+        struct mwifiex_adapter *adapter = priv->adapter;
 
 #ifdef CONFIG_DEBUG_FS
         mwifiex_dev_debugfs_remove(priv);
 #endif
 
-        mwifiex_stop_net_dev_queue(priv->netdev, priv->adapter);
+        mwifiex_stop_net_dev_queue(priv->netdev, adapter);
 
         if (netif_carrier_ok(priv->netdev))
                 netif_carrier_off(priv->netdev);
@@ -2376,16 +2661,48 @@ int mwifiex_del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev)
         if (wdev->netdev->reg_state == NETREG_REGISTERED)
                 unregister_netdevice(wdev->netdev);
 
+        if (priv->dfs_cac_workqueue) {
+                flush_workqueue(priv->dfs_cac_workqueue);
+                destroy_workqueue(priv->dfs_cac_workqueue);
+                priv->dfs_cac_workqueue = NULL;
+        }
+
+        if (priv->dfs_chan_sw_workqueue) {
+                flush_workqueue(priv->dfs_chan_sw_workqueue);
+                destroy_workqueue(priv->dfs_chan_sw_workqueue);
+                priv->dfs_chan_sw_workqueue = NULL;
+        }
         /* Clear the priv in adapter */
         priv->netdev->ieee80211_ptr = NULL;
         priv->netdev = NULL;
-        kfree(wdev);
-        priv->wdev = NULL;
+        priv->wdev.iftype = NL80211_IFTYPE_UNSPECIFIED;
 
         priv->media_connected = false;
 
+        switch (priv->bss_mode) {
+        case NL80211_IFTYPE_UNSPECIFIED:
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_ADHOC:
+                adapter->curr_iface_comb.sta_intf++;
+                break;
+        case NL80211_IFTYPE_AP:
+                adapter->curr_iface_comb.uap_intf++;
+                break;
+        case NL80211_IFTYPE_P2P_CLIENT:
+        case NL80211_IFTYPE_P2P_GO:
+                adapter->curr_iface_comb.p2p_intf++;
+                break;
+        default:
+                dev_err(adapter->dev, "del_virtual_intf: type not supported\n");
+                break;
+        }
+
         priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
 
+        if (GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_STA ||
+            GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_UAP)
+                kfree(priv->hist_data);
+
         return 0;
 }
 EXPORT_SYMBOL_GPL(mwifiex_del_virtual_intf);
@@ -2421,30 +2738,16 @@ mwifiex_is_pattern_supported(struct cfg80211_pkt_pattern *pat, s8 *byte_seq,
 }
 
 #ifdef CONFIG_PM
-static int mwifiex_cfg80211_suspend(struct wiphy *wiphy,
-                                    struct cfg80211_wowlan *wowlan)
+static int mwifiex_set_mef_filter(struct mwifiex_private *priv,
+                                  struct cfg80211_wowlan *wowlan)
 {
-        struct mwifiex_adapter *adapter = mwifiex_cfg80211_get_adapter(wiphy);
-        struct mwifiex_ds_mef_cfg mef_cfg;
-        struct mwifiex_mef_entry *mef_entry;
-        int i, filt_num = 0, ret;
+        int i, filt_num = 0, ret = 0;
         bool first_pat = true;
         u8 byte_seq[MWIFIEX_MEF_MAX_BYTESEQ + 1];
         const u8 ipv4_mc_mac[] = {0x33, 0x33};
         const u8 ipv6_mc_mac[] = {0x01, 0x00, 0x5e};
-        struct mwifiex_private *priv =
-                        mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_STA);
-
-        if (!wowlan) {
-                dev_warn(adapter->dev, "None of the WOWLAN triggers enabled\n");
-                return 0;
-        }
-
-        if (!priv->media_connected) {
-                dev_warn(adapter->dev,
-                         "Can not configure WOWLAN in disconnected state\n");
-                return 0;
-        }
+        struct mwifiex_ds_mef_cfg mef_cfg;
+        struct mwifiex_mef_entry *mef_entry;
 
         mef_entry = kzalloc(sizeof(*mef_entry), GFP_KERNEL);
         if (!mef_entry)
@@ -2459,9 +2762,9 @@ static int mwifiex_cfg80211_suspend(struct wiphy *wiphy,
         for (i = 0; i < wowlan->n_patterns; i++) {
                 memset(byte_seq, 0, sizeof(byte_seq));
                 if (!mwifiex_is_pattern_supported(&wowlan->patterns[i],
-                                                  byte_seq,
-                                                  MWIFIEX_MEF_MAX_BYTESEQ)) {
-                        wiphy_err(wiphy, "Pattern not supported\n");
+                                        byte_seq,
+                                        MWIFIEX_MEF_MAX_BYTESEQ)) {
+                        dev_err(priv->adapter->dev, "Pattern not supported\n");
                         kfree(mef_entry);
                         return -EOPNOTSUPP;
                 }
@@ -2485,9 +2788,9 @@ static int mwifiex_cfg80211_suspend(struct wiphy *wiphy,
 
                 mef_entry->filter[filt_num].repeat = 1;
                 mef_entry->filter[filt_num].offset =
-                                                wowlan->patterns[i].pkt_offset;
+                        wowlan->patterns[i].pkt_offset;
                 memcpy(mef_entry->filter[filt_num].byte_seq, byte_seq,
-                       sizeof(byte_seq));
+                                sizeof(byte_seq));
                 mef_entry->filter[filt_num].filt_type = TYPE_EQ;
 
                 if (first_pat)
@@ -2502,9 +2805,9 @@ static int mwifiex_cfg80211_suspend(struct wiphy *wiphy,
                 mef_cfg.criteria |= MWIFIEX_CRITERIA_UNICAST;
                 mef_entry->filter[filt_num].repeat = 16;
                 memcpy(mef_entry->filter[filt_num].byte_seq, priv->curr_addr,
-                       ETH_ALEN);
+                                ETH_ALEN);
                 mef_entry->filter[filt_num].byte_seq[MWIFIEX_MEF_MAX_BYTESEQ] =
-                                                                ETH_ALEN;
+                        ETH_ALEN;
                 mef_entry->filter[filt_num].offset = 28;
                 mef_entry->filter[filt_num].filt_type = TYPE_EQ;
                 if (filt_num)
@@ -2513,9 +2816,9 @@ static int mwifiex_cfg80211_suspend(struct wiphy *wiphy,
                 filt_num++;
                 mef_entry->filter[filt_num].repeat = 16;
                 memcpy(mef_entry->filter[filt_num].byte_seq, priv->curr_addr,
-                       ETH_ALEN);
+                                ETH_ALEN);
                 mef_entry->filter[filt_num].byte_seq[MWIFIEX_MEF_MAX_BYTESEQ] =
-                                                                ETH_ALEN;
+                        ETH_ALEN;
                 mef_entry->filter[filt_num].offset = 56;
                 mef_entry->filter[filt_num].filt_type = TYPE_EQ;
                 mef_entry->filter[filt_num].filt_action = TYPE_OR;
@@ -2523,16 +2826,61 @@ static int mwifiex_cfg80211_suspend(struct wiphy *wiphy,
 
         if (!mef_cfg.criteria)
                 mef_cfg.criteria = MWIFIEX_CRITERIA_BROADCAST |
-                                   MWIFIEX_CRITERIA_UNICAST |
-                                   MWIFIEX_CRITERIA_MULTICAST;
+                        MWIFIEX_CRITERIA_UNICAST |
+                        MWIFIEX_CRITERIA_MULTICAST;
 
         ret = mwifiex_send_cmd(priv, HostCmd_CMD_MEF_CFG,
-                               HostCmd_ACT_GEN_SET, 0, &mef_cfg, true);
+                        HostCmd_ACT_GEN_SET, 0, &mef_cfg, true);
 
         kfree(mef_entry);
         return ret;
 }
 
+static int mwifiex_cfg80211_suspend(struct wiphy *wiphy,
+                                    struct cfg80211_wowlan *wowlan)
+{
+        struct mwifiex_adapter *adapter = mwifiex_cfg80211_get_adapter(wiphy);
+        struct mwifiex_ds_hs_cfg hs_cfg;
+        int ret = 0;
+        struct mwifiex_private *priv =
+                        mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_STA);
+
+        if (!wowlan) {
+                dev_warn(adapter->dev, "None of the WOWLAN triggers enabled\n");
+                return 0;
+        }
+
+        if (!priv->media_connected) {
+                dev_warn(adapter->dev,
+                         "Can not configure WOWLAN in disconnected state\n");
+                return 0;
+        }
+
+        if (wowlan->n_patterns || wowlan->magic_pkt) {
+                ret = mwifiex_set_mef_filter(priv, wowlan);
+                if (ret) {
+                        dev_err(adapter->dev, "Failed to set MEF filter\n");
+                        return ret;
+                }
+        }
+
+        if (wowlan->disconnect) {
+                memset(&hs_cfg, 0, sizeof(hs_cfg));
+                hs_cfg.is_invoke_hostcmd = false;
+                hs_cfg.conditions = HS_CFG_COND_MAC_EVENT;
+                hs_cfg.gpio = HS_CFG_GPIO_DEF;
+                hs_cfg.gap = HS_CFG_GAP_DEF;
+                ret = mwifiex_set_hs_params(priv, HostCmd_ACT_GEN_SET,
+                                            MWIFIEX_SYNC_CMD, &hs_cfg);
+                if (ret) {
+                        dev_err(adapter->dev, "Failed to set HS params\n");
+                        return ret;
+                }
+        }
+
+        return ret;
+}
+
 static int mwifiex_cfg80211_resume(struct wiphy *wiphy)
 {
         return 0;
@@ -2803,6 +3151,102 @@ mwifiex_cfg80211_add_station(struct wiphy *wiphy, struct net_device *dev,
 }
 
 static int
+mwifiex_cfg80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
+                                struct cfg80211_csa_settings *params)
+{
+        struct ieee_types_header *chsw_ie;
+        struct ieee80211_channel_sw_ie *channel_sw;
+        int chsw_msec;
+        struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
+
+        if (priv->adapter->scan_processing) {
+                dev_err(priv->adapter->dev,
+                        "radar detection: scan in process...\n");
+                return -EBUSY;
+        }
+
+        if (priv->wdev.cac_started)
+                return -EBUSY;
+
+        if (cfg80211_chandef_identical(&params->chandef,
+                                       &priv->dfs_chandef))
+                return -EINVAL;
+
+        chsw_ie = (void *)cfg80211_find_ie(WLAN_EID_CHANNEL_SWITCH,
+                                           params->beacon_csa.tail,
+                                           params->beacon_csa.tail_len);
+        if (!chsw_ie) {
+                dev_err(priv->adapter->dev,
+                        "Could not parse channel switch announcement IE\n");
+                return -EINVAL;
+        }
+
+        channel_sw = (void *)(chsw_ie + 1);
+        if (channel_sw->mode) {
+                if (netif_carrier_ok(priv->netdev))
+                        netif_carrier_off(priv->netdev);
+                mwifiex_stop_net_dev_queue(priv->netdev, priv->adapter);
+        }
+
+        if (mwifiex_del_mgmt_ies(priv))
+                wiphy_err(wiphy, "Failed to delete mgmt IEs!\n");
+
+        if (mwifiex_set_mgmt_ies(priv, &params->beacon_csa)) {
+                wiphy_err(wiphy, "%s: setting mgmt ies failed\n", __func__);
+                return -EFAULT;
+        }
+
+        memcpy(&priv->dfs_chandef, &params->chandef, sizeof(priv->dfs_chandef));
+        memcpy(&priv->beacon_after, &params->beacon_after,
+               sizeof(priv->beacon_after));
+
+        chsw_msec = max(channel_sw->count * priv->bss_cfg.beacon_period, 100);
+        queue_delayed_work(priv->dfs_chan_sw_workqueue, &priv->dfs_chan_sw_work,
+                           msecs_to_jiffies(chsw_msec));
+        return 0;
+}
+
+static int
+mwifiex_cfg80211_start_radar_detection(struct wiphy *wiphy,
+                                       struct net_device *dev,
+                                       struct cfg80211_chan_def *chandef,
+                                       u32 cac_time_ms)
+{
+        struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
+        struct mwifiex_radar_params radar_params;
+
+        if (priv->adapter->scan_processing) {
+                dev_err(priv->adapter->dev,
+                        "radar detection: scan already in process...\n");
+                return -EBUSY;
+        }
+
+        if (!mwifiex_is_11h_active(priv)) {
+                dev_dbg(priv->adapter->dev, "Enable 11h extensions in FW\n");
+                if (mwifiex_11h_activate(priv, true)) {
+                        dev_err(priv->adapter->dev,
+                                "Failed to activate 11h extensions!!");
+                        return -1;
+                }
+                priv->state_11h.is_11h_active = true;
+        }
+
+        memset(&radar_params, 0, sizeof(struct mwifiex_radar_params));
+        radar_params.chandef = chandef;
+        radar_params.cac_time_ms = cac_time_ms;
+
+        memcpy(&priv->dfs_chandef, chandef, sizeof(priv->dfs_chandef));
+
+        if (mwifiex_send_cmd(priv, HostCmd_CMD_CHAN_REPORT_REQUEST,
+                             HostCmd_ACT_GEN_SET, 0, &radar_params, true))
+                return -1;
+
+        queue_delayed_work(priv->dfs_cac_workqueue, &priv->dfs_cac_work,
+                           msecs_to_jiffies(cac_time_ms));
+        return 0;
+}
+
+static int
 mwifiex_cfg80211_change_station(struct wiphy *wiphy, struct net_device *dev,
                                 const u8 *mac,
                                 struct station_parameters *params)
@@ -2866,11 +3310,13 @@ static struct cfg80211_ops mwifiex_cfg80211_ops = {
         .tdls_oper = mwifiex_cfg80211_tdls_oper,
         .add_station = mwifiex_cfg80211_add_station,
         .change_station = mwifiex_cfg80211_change_station,
+        .start_radar_detection = mwifiex_cfg80211_start_radar_detection,
+        .channel_switch = mwifiex_cfg80211_channel_switch,
 };
 
 #ifdef CONFIG_PM
 static const struct wiphy_wowlan_support mwifiex_wowlan_support = {
-        .flags = WIPHY_WOWLAN_MAGIC_PKT,
+        .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
         .n_patterns = MWIFIEX_MEF_MAX_FILTERS,
         .pattern_min_len = 1,
         .pattern_max_len = MWIFIEX_MAX_PATTERN_LEN,
@@ -2964,12 +3410,13 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter)
         wiphy->cipher_suites = mwifiex_cipher_suites;
         wiphy->n_cipher_suites = ARRAY_SIZE(mwifiex_cipher_suites);
 
-        memcpy(wiphy->perm_addr, priv->curr_addr, ETH_ALEN);
+        ether_addr_copy(wiphy->perm_addr, adapter->perm_addr);
         wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
         wiphy->flags |= WIPHY_FLAG_HAVE_AP_SME |
                         WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD |
                         WIPHY_FLAG_AP_UAPSD |
-                        WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
+                        WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
+                        WIPHY_FLAG_HAS_CHANNEL_SWITCH;
 
         if (ISSUPP_TDLS_ENABLED(adapter->fw_cap_info))
                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS |
diff --git a/drivers/net/wireless/mwifiex/cfp.c b/drivers/net/wireless/mwifiex/cfp.c
index b8242eb2be6f..e9df8826f124 100644
--- a/drivers/net/wireless/mwifiex/cfp.c
+++ b/drivers/net/wireless/mwifiex/cfp.c
@@ -322,9 +322,9 @@ mwifiex_get_cfp(struct mwifiex_private *priv, u8 band, u16 channel, u32 freq)
                 return cfp;
 
         if (mwifiex_band_to_radio_type(band) == HostCmd_SCAN_RADIO_TYPE_BG)
-                sband = priv->wdev->wiphy->bands[IEEE80211_BAND_2GHZ];
+                sband = priv->wdev.wiphy->bands[IEEE80211_BAND_2GHZ];
         else
-                sband = priv->wdev->wiphy->bands[IEEE80211_BAND_5GHZ];
+                sband = priv->wdev.wiphy->bands[IEEE80211_BAND_5GHZ];
 
         if (!sband) {
                 dev_err(priv->adapter->dev, "%s: cannot find cfp by band %d\n",
@@ -509,3 +509,21 @@ u32 mwifiex_get_supported_rates(struct mwifiex_private *priv, u8 *rates)
 
         return k;
 }
+
+u8 mwifiex_adjust_data_rate(struct mwifiex_private *priv,
+                            u8 rx_rate, u8 rate_info)
+{
+        u8 rate_index = 0;
+
+        /* HT40 */
+        if ((rate_info & BIT(0)) && (rate_info & BIT(1)))
+                rate_index = MWIFIEX_RATE_INDEX_MCS0 +
+                             MWIFIEX_BW20_MCS_NUM + rx_rate;
+        else if (rate_info & BIT(0)) /* HT20 */
+                rate_index = MWIFIEX_RATE_INDEX_MCS0 + rx_rate;
+        else
+                rate_index = (rx_rate > MWIFIEX_RATE_INDEX_OFDM0) ?
+                              rx_rate - 1 : rx_rate;
+
+        return rate_index;
+}
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index 85597200badc..c5a14ff7eb82 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -315,22 +315,19 @@ static int mwifiex_dnld_sleep_confirm_cmd(struct mwifiex_adapter *adapter)
                 adapter->dbg.num_cmd_sleep_cfm_host_to_card_failure++;
                 return -1;
         }
-        if (GET_BSS_ROLE(mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_ANY))
-            == MWIFIEX_BSS_ROLE_STA) {
-                if (!le16_to_cpu(sleep_cfm_buf->resp_ctrl))
-                        /* Response is not needed for sleep
-                           confirm command */
-                        adapter->ps_state = PS_STATE_SLEEP;
-                else
-                        adapter->ps_state = PS_STATE_SLEEP_CFM;
-
-                if (!le16_to_cpu(sleep_cfm_buf->resp_ctrl) &&
-                    (adapter->is_hs_configured &&
-                     !adapter->sleep_period.period)) {
-                        adapter->pm_wakeup_card_req = true;
-                        mwifiex_hs_activated_event(mwifiex_get_priv
-                                        (adapter, MWIFIEX_BSS_ROLE_STA), true);
-                }
+
+        if (!le16_to_cpu(sleep_cfm_buf->resp_ctrl))
+                /* Response is not needed for sleep confirm command */
+                adapter->ps_state = PS_STATE_SLEEP;
+        else
+                adapter->ps_state = PS_STATE_SLEEP_CFM;
+
+        if (!le16_to_cpu(sleep_cfm_buf->resp_ctrl) &&
+            (adapter->is_hs_configured &&
+             !adapter->sleep_period.period)) {
+                adapter->pm_wakeup_card_req = true;
+                mwifiex_hs_activated_event(mwifiex_get_priv
+                                (adapter, MWIFIEX_BSS_ROLE_ANY), true);
         }
 
         return ret;
@@ -450,6 +447,7 @@ int mwifiex_process_event(struct mwifiex_adapter *adapter)
                                       EVENT_GET_BSS_TYPE(eventcause));
         if (!priv)
                 priv = mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_ANY);
+
         /* Clear BSS_NO_BITS from event */
         eventcause &= EVENT_ID_MASK;
         adapter->event_cause = eventcause;
@@ -462,12 +460,6 @@ int mwifiex_process_event(struct mwifiex_adapter *adapter)
         }
 
         dev_dbg(adapter->dev, "EVENT: cause: %#x\n", eventcause);
-        if (eventcause == EVENT_PS_SLEEP || eventcause == EVENT_PS_AWAKE) {
-                /* Handle PS_SLEEP/AWAKE events on STA */
-                priv = mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_STA);
-                if (!priv)
-                        priv = mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_ANY);
-        }
 
         if (priv->bss_role == MWIFIEX_BSS_ROLE_UAP)
                 ret = mwifiex_process_uap_event(priv);
@@ -1008,11 +1000,9 @@ mwifiex_cancel_all_pending_cmd(struct mwifiex_adapter *adapter)
         list_for_each_entry_safe(cmd_node, tmp_node,
                                  &adapter->scan_pending_q, list) {
                 list_del(&cmd_node->list);
-                spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags);
 
                 cmd_node->wait_q_enabled = false;
                 mwifiex_insert_cmd_to_free_q(adapter, cmd_node);
-                spin_lock_irqsave(&adapter->scan_pending_q_lock, flags);
         }
         spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags);
 
@@ -1070,12 +1060,8 @@ mwifiex_cancel_pending_ioctl(struct mwifiex_adapter *adapter)
         list_for_each_entry_safe(cmd_node, tmp_node,
                                  &adapter->scan_pending_q, list) {
                 list_del(&cmd_node->list);
-                spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
-                                       scan_pending_q_flags);
                 cmd_node->wait_q_enabled = false;
                 mwifiex_insert_cmd_to_free_q(adapter, cmd_node);
-                spin_lock_irqsave(&adapter->scan_pending_q_lock,
-                                  scan_pending_q_flags);
         }
         spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
                                scan_pending_q_flags);
@@ -1588,9 +1574,7 @@ int mwifiex_ret_get_hw_spec(struct mwifiex_private *priv,
                 le16_to_cpu(hw_spec->hw_if_version),
                 le16_to_cpu(hw_spec->version));
 
-        if (priv->curr_addr[0] == 0xff)
-                memmove(priv->curr_addr, hw_spec->permanent_addr, ETH_ALEN);
-
+        ether_addr_copy(priv->adapter->perm_addr, hw_spec->permanent_addr);
         adapter->region_code = le16_to_cpu(hw_spec->region_code);
 
         for (i = 0; i < MWIFIEX_MAX_REGION_CODE; i++)
diff --git a/drivers/net/wireless/mwifiex/debugfs.c b/drivers/net/wireless/mwifiex/debugfs.c
index 2713f7acd35e..1fb329dc6744 100644
--- a/drivers/net/wireless/mwifiex/debugfs.c
+++ b/drivers/net/wireless/mwifiex/debugfs.c
@@ -39,111 +39,6 @@ static char *bss_modes[] = {
         "P2P_DEVICE",
 };
 
-/* size/addr for mwifiex_debug_info */
-#define item_size(n)            (FIELD_SIZEOF(struct mwifiex_debug_info, n))
-#define item_addr(n)            (offsetof(struct mwifiex_debug_info, n))
-
-/* size/addr for struct mwifiex_adapter */
-#define adapter_item_size(n)    (FIELD_SIZEOF(struct mwifiex_adapter, n))
-#define adapter_item_addr(n)    (offsetof(struct mwifiex_adapter, n))
-
-struct mwifiex_debug_data {
-        char name[32];          /* variable/array name */
-        u32 size;               /* size of the variable/array */
-        size_t addr;            /* address of the variable/array */
-        int num;                /* number of variables in an array */
-};
-
-static struct mwifiex_debug_data items[] = {
-        {"int_counter", item_size(int_counter),
-         item_addr(int_counter), 1},
-        {"wmm_ac_vo", item_size(packets_out[WMM_AC_VO]),
-         item_addr(packets_out[WMM_AC_VO]), 1},
-        {"wmm_ac_vi", item_size(packets_out[WMM_AC_VI]),
-         item_addr(packets_out[WMM_AC_VI]), 1},
-        {"wmm_ac_be", item_size(packets_out[WMM_AC_BE]),
-         item_addr(packets_out[WMM_AC_BE]), 1},
-        {"wmm_ac_bk", item_size(packets_out[WMM_AC_BK]),
-         item_addr(packets_out[WMM_AC_BK]), 1},
-        {"tx_buf_size", item_size(tx_buf_size),
-         item_addr(tx_buf_size), 1},
-        {"curr_tx_buf_size", item_size(curr_tx_buf_size),
-         item_addr(curr_tx_buf_size), 1},
-        {"ps_mode", item_size(ps_mode),
-         item_addr(ps_mode), 1},
-        {"ps_state", item_size(ps_state),
-         item_addr(ps_state), 1},
-        {"is_deep_sleep", item_size(is_deep_sleep),
-         item_addr(is_deep_sleep), 1},
-        {"wakeup_dev_req", item_size(pm_wakeup_card_req),
-         item_addr(pm_wakeup_card_req), 1},
-        {"wakeup_tries", item_size(pm_wakeup_fw_try),
-         item_addr(pm_wakeup_fw_try), 1},
-        {"hs_configured", item_size(is_hs_configured),
-         item_addr(is_hs_configured), 1},
-        {"hs_activated", item_size(hs_activated),
-         item_addr(hs_activated), 1},
-        {"num_tx_timeout", item_size(num_tx_timeout),
-         item_addr(num_tx_timeout), 1},
-        {"is_cmd_timedout", item_size(is_cmd_timedout),
-         item_addr(is_cmd_timedout), 1},
-        {"timeout_cmd_id", item_size(timeout_cmd_id),
-         item_addr(timeout_cmd_id), 1},
-        {"timeout_cmd_act", item_size(timeout_cmd_act),
-         item_addr(timeout_cmd_act), 1},
-        {"last_cmd_id", item_size(last_cmd_id),
-         item_addr(last_cmd_id), DBG_CMD_NUM},
-        {"last_cmd_act", item_size(last_cmd_act),
-         item_addr(last_cmd_act), DBG_CMD_NUM},
-        {"last_cmd_index", item_size(last_cmd_index),
-         item_addr(last_cmd_index), 1},
-        {"last_cmd_resp_id", item_size(last_cmd_resp_id),
-         item_addr(last_cmd_resp_id), DBG_CMD_NUM},
-        {"last_cmd_resp_index", item_size(last_cmd_resp_index),
-         item_addr(last_cmd_resp_index), 1},
-        {"last_event", item_size(last_event),
-         item_addr(last_event), DBG_CMD_NUM},
-        {"last_event_index", item_size(last_event_index),
-         item_addr(last_event_index), 1},
-        {"num_cmd_h2c_fail", item_size(num_cmd_host_to_card_failure),
-         item_addr(num_cmd_host_to_card_failure), 1},
-        {"num_cmd_sleep_cfm_fail",
-         item_size(num_cmd_sleep_cfm_host_to_card_failure),
-         item_addr(num_cmd_sleep_cfm_host_to_card_failure), 1},
-        {"num_tx_h2c_fail", item_size(num_tx_host_to_card_failure),
-         item_addr(num_tx_host_to_card_failure), 1},
-        {"num_evt_deauth", item_size(num_event_deauth),
-         item_addr(num_event_deauth), 1},
-        {"num_evt_disassoc", item_size(num_event_disassoc),
-         item_addr(num_event_disassoc), 1},
-        {"num_evt_link_lost", item_size(num_event_link_lost),
-         item_addr(num_event_link_lost), 1},
-        {"num_cmd_deauth", item_size(num_cmd_deauth),
-         item_addr(num_cmd_deauth), 1},
-        {"num_cmd_assoc_ok", item_size(num_cmd_assoc_success),
-         item_addr(num_cmd_assoc_success), 1},
-        {"num_cmd_assoc_fail", item_size(num_cmd_assoc_failure),
-         item_addr(num_cmd_assoc_failure), 1},
-        {"cmd_sent", item_size(cmd_sent),
-         item_addr(cmd_sent), 1},
-        {"data_sent", item_size(data_sent),
-         item_addr(data_sent), 1},
-        {"cmd_resp_received", item_size(cmd_resp_received),
-         item_addr(cmd_resp_received), 1},
-        {"event_received", item_size(event_received),
-         item_addr(event_received), 1},
-
-        /* variables defined in struct mwifiex_adapter */
-        {"cmd_pending", adapter_item_size(cmd_pending),
-         adapter_item_addr(cmd_pending), 1},
-        {"tx_pending", adapter_item_size(tx_pending),
-         adapter_item_addr(tx_pending), 1},
-        {"rx_pending", adapter_item_size(rx_pending),
-         adapter_item_addr(rx_pending), 1},
-};
-
-static int num_of_items = ARRAY_SIZE(items);
-
 /*
  * Proc info file read handler.
  *
@@ -297,6 +192,8 @@ mwifiex_fw_dump_read(struct file *file, char __user *ubuf,
  *      - Number of FCS errors
  *      - Number of Tx frames
  *      - WEP ICV error counts
+ *      - Number of received beacons
+ *      - Number of missed beacons
  */
 static ssize_t
 mwifiex_getlog_read(struct file *file, char __user *ubuf,
@@ -333,7 +230,9 @@ mwifiex_getlog_read(struct file *file, char __user *ubuf,
                      "wepicverrcnt-1   %u\n"
                      "wepicverrcnt-2   %u\n"
                      "wepicverrcnt-3   %u\n"
-                     "wepicverrcnt-4   %u\n",
+                     "wepicverrcnt-4   %u\n"
+                     "bcn_rcv_cnt   %u\n"
+                     "bcn_miss_cnt   %u\n",
                      stats.mcast_tx_frame,
                      stats.failed,
                      stats.retry,
@@ -349,7 +248,9 @@ mwifiex_getlog_read(struct file *file, char __user *ubuf,
                      stats.wep_icv_error[0],
                      stats.wep_icv_error[1],
                      stats.wep_icv_error[2],
-                     stats.wep_icv_error[3]);
+                     stats.wep_icv_error[3],
+                     stats.bcn_rcv_cnt,
+                     stats.bcn_miss_cnt);
 
 
         ret = simple_read_from_buffer(ubuf, count, ppos, (char *) page,
@@ -360,6 +261,103 @@ free_and_exit:
         return ret;
 }
 
+/* Sysfs histogram file read handler.
+ *
+ * This function is called when the 'histogram' file is opened for reading
+ * It prints the following histogram information -
+ *      - Number of histogram samples
+ *      - Receive packet number of each rx_rate
+ *      - Receive packet number of each snr
+ *      - Receive packet number of each nosie_flr
+ *      - Receive packet number of each signal streath
+ */
+static ssize_t
+mwifiex_histogram_read(struct file *file, char __user *ubuf,
+                       size_t count, loff_t *ppos)
+{
+        struct mwifiex_private *priv =
+                (struct mwifiex_private *)file->private_data;
+        ssize_t ret;
+        struct mwifiex_histogram_data *phist_data;
+        int i, value;
+        unsigned long page = get_zeroed_page(GFP_KERNEL);
+        char *p = (char *)page;
+
+        if (!p)
+                return -ENOMEM;
+
+        if (!priv || !priv->hist_data)
+                return -EFAULT;
+        phist_data = priv->hist_data;
+
+        p += sprintf(p, "\n"
+                     "total samples = %d\n",
+                     atomic_read(&phist_data->num_samples));
+
+        p += sprintf(p, "rx rates (in Mbps): 0=1M   1=2M");
+        p += sprintf(p, "2=5.5M  3=11M   4=6M   5=9M  6=12M\n");
+        p += sprintf(p, "7=18M  8=24M  9=36M  10=48M  11=54M");
+        p += sprintf(p, "12-27=MCS0-15(BW20) 28-43=MCS0-15(BW40)\n");
+
+        if (ISSUPP_11ACENABLED(priv->adapter->fw_cap_info)) {
+                p += sprintf(p, "44-53=MCS0-9(VHT:BW20)");
+                p += sprintf(p, "54-63=MCS0-9(VHT:BW40)");
+                p += sprintf(p, "64-73=MCS0-9(VHT:BW80)\n\n");
+        } else {
+                p += sprintf(p, "\n");
+        }
+
+        for (i = 0; i < MWIFIEX_MAX_RX_RATES; i++) {
+                value = atomic_read(&phist_data->rx_rate[i]);
+                if (value)
+                        p += sprintf(p, "rx_rate[%02d] = %d\n", i, value);
+        }
+
+        if (ISSUPP_11ACENABLED(priv->adapter->fw_cap_info)) {
+                for (i = MWIFIEX_MAX_RX_RATES; i < MWIFIEX_MAX_AC_RX_RATES;
+                     i++) {
+                        value = atomic_read(&phist_data->rx_rate[i]);
+                        if (value)
+                                p += sprintf(p, "rx_rate[%02d] = %d\n",
+                                           i, value);
+                }
+        }
+
+        for (i = 0; i < MWIFIEX_MAX_SNR; i++) {
+                value =  atomic_read(&phist_data->snr[i]);
+                if (value)
+                        p += sprintf(p, "snr[%02ddB] = %d\n", i, value);
+        }
+        for (i = 0; i < MWIFIEX_MAX_NOISE_FLR; i++) {
+                value = atomic_read(&phist_data->noise_flr[i]);
+                if (value)
+                        p += sprintf(p, "noise_flr[-%02ddBm] = %d\n",
+                                (int)(i-128), value);
+        }
+        for (i = 0; i < MWIFIEX_MAX_SIG_STRENGTH; i++) {
+                value = atomic_read(&phist_data->sig_str[i]);
+                if (value)
+                        p += sprintf(p, "sig_strength[-%02ddBm] = %d\n",
+                                i, value);
+        }
+
+        ret = simple_read_from_buffer(ubuf, count, ppos, (char *)page,
+                                      (unsigned long)p - page);
+
+        return ret;
+}
+
+static ssize_t
+mwifiex_histogram_write(struct file *file, const char __user *ubuf,
+                        size_t count, loff_t *ppos)
+{
+        struct mwifiex_private *priv = (void *)file->private_data;
+
+        if (priv && priv->hist_data)
+                mwifiex_hist_data_reset(priv);
+        return 0;
+}
+
 static struct mwifiex_debug_info info;
 
 /*
@@ -415,13 +413,9 @@ mwifiex_debug_read(struct file *file, char __user *ubuf,
 {
         struct mwifiex_private *priv =
                 (struct mwifiex_private *) file->private_data;
-        struct mwifiex_debug_data *d = &items[0];
         unsigned long page = get_zeroed_page(GFP_KERNEL);
         char *p = (char *) page;
         ssize_t ret;
-        size_t size, addr;
-        long val;
-        int i, j;
 
         if (!p)
                 return -ENOMEM;
@@ -430,68 +424,7 @@ mwifiex_debug_read(struct file *file, char __user *ubuf,
         if (ret)
                 goto free_and_exit;
 
-        for (i = 0; i < num_of_items; i++) {
-                p += sprintf(p, "%s=", d[i].name);
-
-                size = d[i].size / d[i].num;
-
-                if (i < (num_of_items - 3))
-                        addr = d[i].addr + (size_t) &info;
-                else /* The last 3 items are struct mwifiex_adapter variables */
-                        addr = d[i].addr + (size_t) priv->adapter;
-
-                for (j = 0; j < d[i].num; j++) {
-                        switch (size) {
-                        case 1:
-                                val = *((u8 *) addr);
-                                break;
-                        case 2:
-                                val = *((u16 *) addr);
-                                break;
-                        case 4:
-                                val = *((u32 *) addr);
-                                break;
-                        case 8:
-                                val = *((long long *) addr);
-                                break;
-                        default:
-                                val = -1;
-                                break;
-                        }
-
-                        p += sprintf(p, "%#lx ", val);
-                        addr += size;
-                }
-
-                p += sprintf(p, "\n");
-        }
-
-        if (info.tx_tbl_num) {
-                p += sprintf(p, "Tx BA stream table:\n");
-                for (i = 0; i < info.tx_tbl_num; i++)
-                        p += sprintf(p, "tid = %d, ra = %pM\n",
-                                     info.tx_tbl[i].tid, info.tx_tbl[i].ra);
-        }
-
-        if (info.rx_tbl_num) {
-                p += sprintf(p, "Rx reorder table:\n");
-                for (i = 0; i < info.rx_tbl_num; i++) {
-                        p += sprintf(p, "tid = %d, ta = %pM, "
-                                     "start_win = %d, "
-                                     "win_size = %d, buffer: ",
-                                     info.rx_tbl[i].tid,
-                                     info.rx_tbl[i].ta,
-                                     info.rx_tbl[i].start_win,
-                                     info.rx_tbl[i].win_size);
-
-                        for (j = 0; j < info.rx_tbl[i].win_size; j++)
-                                p += sprintf(p, "%c ",
-                                             info.rx_tbl[i].buffer[j] ?
-                                             '1' : '0');
-
-                        p += sprintf(p, "\n");
-                }
-        }
+        p += mwifiex_debug_info_to_buffer(priv, p, &info);
 
         ret = simple_read_from_buffer(ubuf, count, ppos, (char *) page,
                                       (unsigned long) p - page);
@@ -817,6 +750,7 @@ MWIFIEX_DFS_FILE_READ_OPS(fw_dump);
 MWIFIEX_DFS_FILE_OPS(regrdwr);
 MWIFIEX_DFS_FILE_OPS(rdeeprom);
 MWIFIEX_DFS_FILE_OPS(hscfg);
+MWIFIEX_DFS_FILE_OPS(histogram);
 
 /*
  * This function creates the debug FS directory structure and the files.
@@ -840,6 +774,7 @@ mwifiex_dev_debugfs_init(struct mwifiex_private *priv)
         MWIFIEX_DFS_ADD_FILE(rdeeprom);
         MWIFIEX_DFS_ADD_FILE(fw_dump);
         MWIFIEX_DFS_ADD_FILE(hscfg);
+        MWIFIEX_DFS_ADD_FILE(histogram);
 }
 
 /*
diff --git a/drivers/net/wireless/mwifiex/decl.h b/drivers/net/wireless/mwifiex/decl.h
index 2269acf41ad8..88d0eade6bb1 100644
--- a/drivers/net/wireless/mwifiex/decl.h
+++ b/drivers/net/wireless/mwifiex/decl.h
@@ -32,15 +32,19 @@
 
 #define MWIFIEX_MAX_BSS_NUM         (3)
 
-#define MWIFIEX_MIN_DATA_HEADER_LEN 36  /* sizeof(mwifiex_txpd)
-                                         *   + 4 byte alignment
-                                         */
+#define MWIFIEX_DMA_ALIGN_SZ        64
+#define MAX_TXPD_SZ                 32
+#define INTF_HDR_ALIGN               4
+
+#define MWIFIEX_MIN_DATA_HEADER_LEN (MWIFIEX_DMA_ALIGN_SZ + INTF_HDR_ALIGN + \
+                                     MAX_TXPD_SZ)
 #define MWIFIEX_MGMT_FRAME_HEADER_SIZE  8       /* sizeof(pkt_type)
                                                  *   + sizeof(tx_control)
                                                  */
 
 #define MWIFIEX_MAX_TX_BASTREAM_SUPPORTED       2
 #define MWIFIEX_MAX_RX_BASTREAM_SUPPORTED       16
+#define MWIFIEX_MAX_TDLS_PEER_SUPPORTED 8
 
 #define MWIFIEX_STA_AMPDU_DEF_TXWINSIZE        64
 #define MWIFIEX_STA_AMPDU_DEF_RXWINSIZE        64
@@ -92,6 +96,20 @@
 #define MWIFIEX_TDLS_MAX_FAIL_COUNT      4
 #define MWIFIEX_AUTO_TDLS_IDLE_TIME     10
 
+/* 54M rates, index from 0 to 11 */
+#define MWIFIEX_RATE_INDEX_MCS0 12
+/* 12-27=MCS0-15(BW20) */
+#define MWIFIEX_BW20_MCS_NUM 15
+
+/* Rate index for OFDM 0 */
+#define MWIFIEX_RATE_INDEX_OFDM0   4
+
+#define MWIFIEX_MAX_STA_NUM             1
+#define MWIFIEX_MAX_UAP_NUM             1
+#define MWIFIEX_MAX_P2P_NUM             1
+
+#define MWIFIEX_A_BAND_START_FREQ       5000
+
 enum mwifiex_bss_type {
         MWIFIEX_BSS_TYPE_STA = 0,
         MWIFIEX_BSS_TYPE_UAP = 1,
@@ -204,4 +222,35 @@ struct mwifiex_chan_stats {
         u16 cca_scan_dur;
         u16 cca_busy_dur;
 } __packed;
+
+#define MWIFIEX_HIST_MAX_SAMPLES        1048576
+#define MWIFIEX_MAX_RX_RATES                 44
+#define MWIFIEX_MAX_AC_RX_RATES              74
+#define MWIFIEX_MAX_SNR                     256
+#define MWIFIEX_MAX_NOISE_FLR               256
+#define MWIFIEX_MAX_SIG_STRENGTH            256
+
+struct mwifiex_histogram_data {
+        atomic_t rx_rate[MWIFIEX_MAX_AC_RX_RATES];
+        atomic_t snr[MWIFIEX_MAX_SNR];
+        atomic_t noise_flr[MWIFIEX_MAX_NOISE_FLR];
+        atomic_t sig_str[MWIFIEX_MAX_SIG_STRENGTH];
+        atomic_t num_samples;
+};
+
+struct mwifiex_iface_comb {
+        u8 sta_intf;
+        u8 uap_intf;
+        u8 p2p_intf;
+};
+
+struct mwifiex_radar_params {
+        struct cfg80211_chan_def *chandef;
+        u32 cac_time_ms;
+} __packed;
+
+struct mwifiex_11h_intf_state {
+        bool is_11h_enabled;
+        bool is_11h_active;
+} __packed;
 #endif /* !_MWIFIEX_DECL_H_ */
diff --git a/drivers/net/wireless/mwifiex/ethtool.c b/drivers/net/wireless/mwifiex/ethtool.c
index 04e56b5fc535..65d8d6d4b6ba 100644
--- a/drivers/net/wireless/mwifiex/ethtool.c
+++ b/drivers/net/wireless/mwifiex/ethtool.c
@@ -76,7 +76,9 @@ mwifiex_get_dump_flag(struct net_device *dev, struct ethtool_dump *dump)
 
         dump->flag = adapter->curr_mem_idx;
         dump->version = 1;
-        if (adapter->curr_mem_idx != MWIFIEX_FW_DUMP_IDX) {
+        if (adapter->curr_mem_idx == MWIFIEX_DRV_INFO_IDX) {
+                dump->len = adapter->drv_info_size;
+        } else if (adapter->curr_mem_idx != MWIFIEX_FW_DUMP_IDX) {
                 entry = &adapter->mem_type_mapping_tbl[adapter->curr_mem_idx];
                 dump->len = entry->mem_size;
         } else {
@@ -98,6 +100,13 @@ mwifiex_get_dump_data(struct net_device *dev, struct ethtool_dump *dump,
         if (!adapter->if_ops.fw_dump)
                 return -ENOTSUPP;
 
+        if (adapter->curr_mem_idx == MWIFIEX_DRV_INFO_IDX) {
+                if (!adapter->drv_info_dump)
+                        return -EFAULT;
+                memcpy(p, adapter->drv_info_dump, adapter->drv_info_size);
+                return 0;
+        }
+
         if (adapter->curr_mem_idx == MWIFIEX_FW_DUMP_IDX) {
                 dev_err(adapter->dev, "firmware dump in progress!!\n");
                 return -EBUSY;
@@ -125,6 +134,11 @@ static int mwifiex_set_dump(struct net_device *dev, struct ethtool_dump *val)
         if (!adapter->if_ops.fw_dump)
                 return -ENOTSUPP;
 
+        if (val->flag == MWIFIEX_DRV_INFO_IDX) {
+                adapter->curr_mem_idx = MWIFIEX_DRV_INFO_IDX;
+                return 0;
+        }
+
         if (adapter->curr_mem_idx == MWIFIEX_FW_DUMP_IDX) {
                 dev_err(adapter->dev, "firmware dump in progress!!\n");
                 return -EBUSY;
diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
index fb5936eb82e3..df553e86a0ad 100644
--- a/drivers/net/wireless/mwifiex/fw.h
+++ b/drivers/net/wireless/mwifiex/fw.h
@@ -158,6 +158,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 #define TLV_TYPE_POWER_GROUP        (PROPRIETARY_TLV_BASE_ID + 84)
 #define TLV_TYPE_BSS_SCAN_RSP       (PROPRIETARY_TLV_BASE_ID + 86)
 #define TLV_TYPE_BSS_SCAN_INFO      (PROPRIETARY_TLV_BASE_ID + 87)
+#define TLV_TYPE_CHANRPT_11H_BASIC  (PROPRIETARY_TLV_BASE_ID + 91)
 #define TLV_TYPE_UAP_RETRY_LIMIT    (PROPRIETARY_TLV_BASE_ID + 93)
 #define TLV_TYPE_WAPI_IE            (PROPRIETARY_TLV_BASE_ID + 94)
 #define TLV_TYPE_UAP_MGMT_FRAME     (PROPRIETARY_TLV_BASE_ID + 104)
@@ -233,6 +234,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 #define ISSUPP_RXLDPC(Dot11nDevCap) (Dot11nDevCap & BIT(22))
 #define ISSUPP_BEAMFORMING(Dot11nDevCap) (Dot11nDevCap & BIT(30))
 #define ISALLOWED_CHANWIDTH40(ht_param) (ht_param & BIT(2))
+#define GETSUPP_TXBASTREAMS(Dot11nDevCap) ((Dot11nDevCap >> 18) & 0xF)
 
 /* httxcfg bitmap
  * 0            reserved
@@ -335,6 +337,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 #define HostCmd_CMD_11N_ADDBA_RSP                     0x00cf
 #define HostCmd_CMD_11N_DELBA                         0x00d0
 #define HostCmd_CMD_RECONFIGURE_TX_BUFF               0x00d9
+#define HostCmd_CMD_CHAN_REPORT_REQUEST               0x00dd
 #define HostCmd_CMD_AMSDU_AGGR_CTRL                   0x00df
 #define HostCmd_CMD_TXPWR_CFG                         0x00d1
 #define HostCmd_CMD_TX_RATE_CFG                       0x00d6
@@ -492,6 +495,8 @@ enum P2P_MODES {
 #define EVENT_HOSTWAKE_STAIE            0x0000004d
 #define EVENT_CHANNEL_SWITCH_ANN        0x00000050
 #define EVENT_TDLS_GENERIC_EVENT        0x00000052
+#define EVENT_RADAR_DETECTED            0x00000053
+#define EVENT_CHANNEL_REPORT_RDY        0x00000054
 #define EVENT_EXT_SCAN_REPORT           0x00000058
 #define EVENT_REMAIN_ON_CHAN_EXPIRED    0x0000005f
 #define EVENT_TX_STATUS_REPORT          0x00000074
@@ -529,6 +534,8 @@ enum P2P_MODES {
 
 #define MWIFIEX_FW_V15             15
 
+#define MWIFIEX_MASTER_RADAR_DET_MASK BIT(1)
+
 struct mwifiex_ie_types_header {
         __le16 type;
         __le16 len;
@@ -1076,6 +1083,8 @@ struct host_cmd_ds_802_11_get_log {
         __le32 tx_frame;
         __le32 reserved;
         __le32 wep_icv_err_cnt[4];
+        __le32 bcn_rcv_cnt;
+        __le32 bcn_miss_cnt;
 };
 
 /* Enumeration for rate format */
@@ -1213,6 +1222,24 @@ struct host_cmd_ds_tdls_oper {
         u8 peer_mac[ETH_ALEN];
 } __packed;
 
+struct mwifiex_chan_desc {
+        __le16 start_freq;
+        u8 chan_width;
+        u8 chan_num;
+} __packed;
+
+struct host_cmd_ds_chan_rpt_req {
+        struct mwifiex_chan_desc chan_desc;
+        __le32 msec_dwell_time;
+} __packed;
+
+struct host_cmd_ds_chan_rpt_event {
+        __le32 result;
+        __le64 start_tsf;
+        __le32 duration;
+        u8 tlvbuf[0];
+} __packed;
+
 struct mwifiex_fixed_bcn_param {
         __le64 timestamp;
         __le16 beacon_period;
@@ -1789,6 +1816,39 @@ struct mwifiex_ie_types_rssi_threshold {
         u8 evt_freq;
 } __packed;
 
+#define MWIFIEX_DFS_REC_HDR_LEN         8
+#define MWIFIEX_DFS_REC_HDR_NUM         10
+#define MWIFIEX_BIN_COUNTER_LEN         7
+
+struct mwifiex_radar_det_event {
+        __le32 detect_count;
+        u8 reg_domain;  /*1=fcc, 2=etsi, 3=mic*/
+        u8 det_type;  /*0=none, 1=pw(chirp), 2=pri(radar)*/
+        __le16 pw_chirp_type;
+        u8 pw_chirp_idx;
+        u8 pw_value;
+        u8 pri_radar_type;
+        u8 pri_bincnt;
+        u8 bin_counter[MWIFIEX_BIN_COUNTER_LEN];
+        u8 num_dfs_records;
+        u8 dfs_record_hdr[MWIFIEX_DFS_REC_HDR_NUM][MWIFIEX_DFS_REC_HDR_LEN];
+        __le32 passed;
+} __packed;
+
+struct meas_rpt_map {
+        u8 rssi:3;
+        u8 unmeasured:1;
+        u8 radar:1;
+        u8 unidentified_sig:1;
+        u8 ofdm_preamble:1;
+        u8 bss:1;
+} __packed;
+
+struct mwifiex_ie_types_chan_rpt_data {
+        struct mwifiex_ie_types_header header;
+        struct meas_rpt_map map;
+} __packed;
+
 struct host_cmd_ds_802_11_subsc_evt {
         __le16 action;
         __le16 events;
@@ -1901,6 +1961,7 @@ struct host_cmd_ds_command {
                 struct host_cmd_11ac_vht_cfg vht_cfg;
                 struct host_cmd_ds_coalesce_cfg coalesce_cfg;
                 struct host_cmd_ds_tdls_oper tdls_oper;
+                struct host_cmd_ds_chan_rpt_req chan_rpt_req;
         } params;
 } __packed;
 
diff --git a/drivers/net/wireless/mwifiex/ie.c b/drivers/net/wireless/mwifiex/ie.c
index b933794758b7..f3b6ed249403 100644
--- a/drivers/net/wireless/mwifiex/ie.c
+++ b/drivers/net/wireless/mwifiex/ie.c
@@ -317,27 +317,27 @@ done:
         return ret;
 }
 
-/* This function parses different IEs-tail IEs, beacon IEs, probe response IEs,
- * association response IEs from cfg80211_ap_settings function and sets these IE
- * to FW.
+/* This function parses  head and tail IEs, from cfg80211_beacon_data and sets
+ * these IE to FW.
  */
-int mwifiex_set_mgmt_ies(struct mwifiex_private *priv,
-                         struct cfg80211_beacon_data *info)
+static int mwifiex_uap_set_head_tail_ies(struct mwifiex_private *priv,
+                                         struct cfg80211_beacon_data *info)
 {
         struct mwifiex_ie *gen_ie;
-        struct ieee_types_header *rsn_ie, *wpa_ie = NULL;
-        u16 rsn_idx = MWIFIEX_AUTO_IDX_MASK, ie_len = 0;
+        struct ieee_types_header *rsn_ie = NULL, *wpa_ie = NULL;
+        struct ieee_types_header *chsw_ie = NULL;
+        u16 gen_idx = MWIFIEX_AUTO_IDX_MASK, ie_len = 0;
         const u8 *vendor_ie;
 
-        if (info->tail && info->tail_len) {
-                gen_ie = kzalloc(sizeof(struct mwifiex_ie), GFP_KERNEL);
-                if (!gen_ie)
-                        return -ENOMEM;
-                gen_ie->ie_index = cpu_to_le16(rsn_idx);
-                gen_ie->mgmt_subtype_mask = cpu_to_le16(MGMT_MASK_BEACON |
-                                                        MGMT_MASK_PROBE_RESP |
-                                                        MGMT_MASK_ASSOC_RESP);
+        gen_ie = kzalloc(sizeof(*gen_ie), GFP_KERNEL);
+        if (!gen_ie)
+                return -ENOMEM;
+        gen_ie->ie_index = cpu_to_le16(gen_idx);
+        gen_ie->mgmt_subtype_mask = cpu_to_le16(MGMT_MASK_BEACON |
+                                                MGMT_MASK_PROBE_RESP |
+                                                MGMT_MASK_ASSOC_RESP);
 
+        if (info->tail && info->tail_len) {
                 rsn_ie = (void *)cfg80211_find_ie(WLAN_EID_RSN,
                                                   info->tail, info->tail_len);
                 if (rsn_ie) {
@@ -358,19 +358,41 @@ int mwifiex_set_mgmt_ies(struct mwifiex_private *priv,
                         gen_ie->ie_length = cpu_to_le16(ie_len);
                 }
 
-                if (rsn_ie || wpa_ie) {
-                        if (mwifiex_update_uap_custom_ie(priv, gen_ie, &rsn_idx,
-                                                         NULL, NULL,
-                                                         NULL, NULL)) {
-                                kfree(gen_ie);
-                                return -1;
-                        }
-                        priv->rsn_idx = rsn_idx;
+                chsw_ie = (void *)cfg80211_find_ie(WLAN_EID_CHANNEL_SWITCH,
+                                                   info->tail, info->tail_len);
+                if (chsw_ie) {
+                        memcpy(gen_ie->ie_buffer + ie_len,
+                               chsw_ie, chsw_ie->len + 2);
+                        ie_len += chsw_ie->len + 2;
+                        gen_ie->ie_length = cpu_to_le16(ie_len);
                 }
+        }
 
-                kfree(gen_ie);
+        if (rsn_ie || wpa_ie || chsw_ie) {
+                if (mwifiex_update_uap_custom_ie(priv, gen_ie, &gen_idx, NULL,
+                                                 NULL, NULL, NULL)) {
+                        kfree(gen_ie);
+                        return -1;
+                }
+                priv->gen_idx = gen_idx;
         }
 
+        kfree(gen_ie);
+        return 0;
+}
+
+/* This function parses different IEs-head & tail IEs, beacon IEs,
+ * probe response IEs, association response IEs from cfg80211_ap_settings
+ * function and sets these IE to FW.
+ */
+int mwifiex_set_mgmt_ies(struct mwifiex_private *priv,
+                         struct cfg80211_beacon_data *info)
+{
+        int ret;
+
+        ret = mwifiex_uap_set_head_tail_ies(priv, info);
+                return ret;
+
         return mwifiex_set_mgmt_beacon_data_ies(priv, info);
 }
 
@@ -378,25 +400,25 @@ int mwifiex_set_mgmt_ies(struct mwifiex_private *priv,
 int mwifiex_del_mgmt_ies(struct mwifiex_private *priv)
 {
         struct mwifiex_ie *beacon_ie = NULL, *pr_ie = NULL;
-        struct mwifiex_ie *ar_ie = NULL, *rsn_ie = NULL;
+        struct mwifiex_ie *ar_ie = NULL, *gen_ie = NULL;
         int ret = 0;
 
-        if (priv->rsn_idx != MWIFIEX_AUTO_IDX_MASK) {
-                rsn_ie = kmalloc(sizeof(struct mwifiex_ie), GFP_KERNEL);
-                if (!rsn_ie)
+        if (priv->gen_idx != MWIFIEX_AUTO_IDX_MASK) {
+                gen_ie = kmalloc(sizeof(*gen_ie), GFP_KERNEL);
+                if (!gen_ie)
                         return -ENOMEM;
 
-                rsn_ie->ie_index = cpu_to_le16(priv->rsn_idx);
-                rsn_ie->mgmt_subtype_mask = cpu_to_le16(MWIFIEX_DELETE_MASK);
-                rsn_ie->ie_length = 0;
-                if (mwifiex_update_uap_custom_ie(priv, rsn_ie, &priv->rsn_idx,
+                gen_ie->ie_index = cpu_to_le16(priv->gen_idx);
+                gen_ie->mgmt_subtype_mask = cpu_to_le16(MWIFIEX_DELETE_MASK);
+                gen_ie->ie_length = 0;
+                if (mwifiex_update_uap_custom_ie(priv, gen_ie, &priv->gen_idx,
                                                  NULL, &priv->proberesp_idx,
                                                  NULL, &priv->assocresp_idx)) {
                         ret = -1;
                         goto done;
                 }
 
-                priv->rsn_idx = MWIFIEX_AUTO_IDX_MASK;
+                priv->gen_idx = MWIFIEX_AUTO_IDX_MASK;
         }
 
         if (priv->beacon_idx != MWIFIEX_AUTO_IDX_MASK) {
@@ -440,7 +462,6 @@ done:
         kfree(beacon_ie);
         kfree(pr_ie);
         kfree(ar_ie);
-        kfree(rsn_ie);
 
         return ret;
 }
diff --git a/drivers/net/wireless/mwifiex/init.c b/drivers/net/wireless/mwifiex/init.c
index 520ad4a3018b..b77ba743e1c4 100644
--- a/drivers/net/wireless/mwifiex/init.c
+++ b/drivers/net/wireless/mwifiex/init.c
@@ -52,6 +52,18 @@ static int mwifiex_add_bss_prio_tbl(struct mwifiex_private *priv)
         return 0;
 }
 
+static void wakeup_timer_fn(unsigned long data)
+{
+        struct mwifiex_adapter *adapter = (struct mwifiex_adapter *)data;
+
+        dev_err(adapter->dev, "Firmware wakeup failed\n");
+        adapter->hw_status = MWIFIEX_HW_STATUS_RESET;
+        mwifiex_cancel_all_pending_cmd(adapter);
+
+        if (adapter->if_ops.card_reset)
+                adapter->if_ops.card_reset(adapter);
+}
+
 /*
  * This function initializes the private structure and sets default
  * values to the members.
@@ -140,6 +152,8 @@ int mwifiex_init_priv(struct mwifiex_private *priv)
         priv->check_tdls_tx = false;
         memcpy(priv->tos_to_tid_inv, tos_to_tid_inv, MAX_NUM_TID);
 
+        mwifiex_init_11h_params(priv);
+
         return mwifiex_add_bss_prio_tbl(priv);
 }
 
@@ -282,9 +296,16 @@ static void mwifiex_init_adapter(struct mwifiex_adapter *adapter)
         memset(&adapter->arp_filter, 0, sizeof(adapter->arp_filter));
         adapter->arp_filter_size = 0;
         adapter->max_mgmt_ie_index = MAX_MGMT_IE_INDEX;
-        adapter->ext_scan = true;
+        adapter->ext_scan = false;
         adapter->key_api_major_ver = 0;
         adapter->key_api_minor_ver = 0;
+        memset(adapter->perm_addr, 0xff, ETH_ALEN);
+        adapter->iface_limit.sta_intf = MWIFIEX_MAX_STA_NUM;
+        adapter->iface_limit.uap_intf = MWIFIEX_MAX_UAP_NUM;
+        adapter->iface_limit.p2p_intf = MWIFIEX_MAX_P2P_NUM;
+
+        setup_timer(&adapter->wakeup_timer, wakeup_timer_fn,
+                    (unsigned long)adapter);
 }
 
 /*
@@ -391,7 +412,10 @@ mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
                 return;
         }
 
+        del_timer(&adapter->wakeup_timer);
         mwifiex_cancel_all_pending_cmd(adapter);
+        wake_up_interruptible(&adapter->cmd_wait_q.wait);
+        wake_up_interruptible(&adapter->hs_activate_wait_q);
 
         /* Free lock variables */
         mwifiex_free_lock_list(adapter);
@@ -411,6 +435,11 @@ mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
                 entry->mem_size = 0;
         }
 
+        if (adapter->drv_info_dump) {
+                vfree(adapter->drv_info_dump);
+                adapter->drv_info_size = 0;
+        }
+
         if (adapter->sleep_cfm)
                 dev_kfree_skb_any(adapter->sleep_cfm);
 }
@@ -528,7 +557,8 @@ int mwifiex_init_fw(struct mwifiex_adapter *adapter)
 
         for (i = 0; i < adapter->priv_num; i++) {
                 if (adapter->priv[i]) {
-                        ret = mwifiex_sta_init_cmd(adapter->priv[i], first_sta);
+                        ret = mwifiex_sta_init_cmd(adapter->priv[i], first_sta,
+                                                   true);
                         if (ret == -1)
                                 return -1;
 
@@ -653,6 +683,7 @@ mwifiex_shutdown_drv(struct mwifiex_adapter *adapter)
                         priv = adapter->priv[i];
 
                         mwifiex_clean_auto_tdls(priv);
+                        mwifiex_abort_cac(priv);
                         mwifiex_clean_txrx(priv);
                         mwifiex_delete_bss_prio_tbl(priv);
                 }
diff --git a/drivers/net/wireless/mwifiex/ioctl.h b/drivers/net/wireless/mwifiex/ioctl.h
index 0847f3e07ab7..d2b05c3a96da 100644
--- a/drivers/net/wireless/mwifiex/ioctl.h
+++ b/drivers/net/wireless/mwifiex/ioctl.h
@@ -137,6 +137,8 @@ struct mwifiex_ds_get_stats {
         u32 fcs_error;
         u32 tx_frame;
         u32 wep_icv_error[4];
+        u32 bcn_rcv_cnt;
+        u32 bcn_miss_cnt;
 };
 
 #define MWIFIEX_MAX_VER_STR_LEN    128
@@ -180,7 +182,11 @@ struct mwifiex_ds_tx_ba_stream_tbl {
         u8 amsdu;
 };
 
-#define DBG_CMD_NUM     5
+#define DBG_CMD_NUM    5
+
+struct tdls_peer_info {
+        u8 peer_addr[ETH_ALEN];
+};
 
 struct mwifiex_debug_info {
         u32 int_counter;
@@ -193,6 +199,9 @@ struct mwifiex_debug_info {
         u32 rx_tbl_num;
         struct mwifiex_ds_rx_reorder_tbl rx_tbl
                 [MWIFIEX_MAX_RX_BASTREAM_SUPPORTED];
+        u32 tdls_peer_num;
+        struct tdls_peer_info tdls_list
+                [MWIFIEX_MAX_TDLS_PEER_SUPPORTED];
         u16 ps_mode;
         u32 ps_state;
         u8 is_deep_sleep;
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index d4d2223d1f31..7e74b4fccddd 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -83,9 +83,8 @@ static int mwifiex_register(void *card, struct mwifiex_if_ops *if_ops,
         }
         mwifiex_init_lock_list(adapter);
 
-        init_timer(&adapter->cmd_timer);
-        adapter->cmd_timer.function = mwifiex_cmd_timeout_func;
-        adapter->cmd_timer.data = (unsigned long) adapter;
+        setup_timer(&adapter->cmd_timer, mwifiex_cmd_timeout_func,
+                    (unsigned long)adapter);
 
         return 0;
 
@@ -237,6 +236,7 @@ process_start:
                     (is_command_pending(adapter) ||
                      !mwifiex_wmm_lists_empty(adapter))) {
                         adapter->pm_wakeup_fw_try = true;
+                        mod_timer(&adapter->wakeup_timer, jiffies + (HZ*3));
                         adapter->if_ops.wakeup(adapter);
                         continue;
                 }
@@ -244,6 +244,7 @@ process_start:
                 if (IS_CARD_RX_RCVD(adapter)) {
                         adapter->data_received = false;
                         adapter->pm_wakeup_fw_try = false;
+                        del_timer_sync(&adapter->wakeup_timer);
                         if (adapter->ps_state == PS_STATE_SLEEP)
                                 adapter->ps_state = PS_STATE_AWAKE;
                 } else {
@@ -511,8 +512,7 @@ err_dnld_fw:
         if (adapter->if_ops.unregister_dev)
                 adapter->if_ops.unregister_dev(adapter);
 
-        if ((adapter->hw_status == MWIFIEX_HW_STATUS_FW_READY) ||
-            (adapter->hw_status == MWIFIEX_HW_STATUS_READY)) {
+        if (adapter->hw_status == MWIFIEX_HW_STATUS_READY) {
                 pr_debug("info: %s: shutdown mwifiex\n", __func__);
                 adapter->init_wait_q_woken = false;
 
@@ -562,7 +562,8 @@ static int mwifiex_init_hw_fw(struct mwifiex_adapter *adapter)
 static int
 mwifiex_open(struct net_device *dev)
 {
-        netif_tx_start_all_queues(dev);
+        netif_carrier_off(dev);
+
         return 0;
 }
 
@@ -801,6 +802,114 @@ mwifiex_tx_timeout(struct net_device *dev)
         }
 }
 
+void mwifiex_dump_drv_info(struct mwifiex_adapter *adapter)
+{
+        void *p;
+        char drv_version[64];
+        struct usb_card_rec *cardp;
+        struct sdio_mmc_card *sdio_card;
+        struct mwifiex_private *priv;
+        int i, idx;
+        struct netdev_queue *txq;
+        struct mwifiex_debug_info *debug_info;
+
+        if (adapter->drv_info_dump) {
+                vfree(adapter->drv_info_dump);
+                adapter->drv_info_size = 0;
+        }
+
+        dev_info(adapter->dev, "=== DRIVER INFO DUMP START===\n");
+
+        adapter->drv_info_dump = vzalloc(MWIFIEX_DRV_INFO_SIZE_MAX);
+
+        if (!adapter->drv_info_dump)
+                return;
+
+        p = (char *)(adapter->drv_info_dump);
+        p += sprintf(p, "driver_name = " "\"mwifiex\"\n");
+
+        mwifiex_drv_get_driver_version(adapter, drv_version,
+                                       sizeof(drv_version) - 1);
+        p += sprintf(p, "driver_version = %s\n", drv_version);
+
+        if (adapter->iface_type == MWIFIEX_USB) {
+                cardp = (struct usb_card_rec *)adapter->card;
+                p += sprintf(p, "tx_cmd_urb_pending = %d\n",
+                             atomic_read(&cardp->tx_cmd_urb_pending));
+                p += sprintf(p, "tx_data_urb_pending = %d\n",
+                             atomic_read(&cardp->tx_data_urb_pending));
+                p += sprintf(p, "rx_cmd_urb_pending = %d\n",
+                             atomic_read(&cardp->rx_cmd_urb_pending));
+                p += sprintf(p, "rx_data_urb_pending = %d\n",
+                             atomic_read(&cardp->rx_data_urb_pending));
+        }
+
+        p += sprintf(p, "tx_pending = %d\n",
+                     atomic_read(&adapter->tx_pending));
+        p += sprintf(p, "rx_pending = %d\n",
+                     atomic_read(&adapter->rx_pending));
+
+        if (adapter->iface_type == MWIFIEX_SDIO) {
+                sdio_card = (struct sdio_mmc_card *)adapter->card;
+                p += sprintf(p, "\nmp_rd_bitmap=0x%x curr_rd_port=0x%x\n",
+                             sdio_card->mp_rd_bitmap, sdio_card->curr_rd_port);
+                p += sprintf(p, "mp_wr_bitmap=0x%x curr_wr_port=0x%x\n",
+                             sdio_card->mp_wr_bitmap, sdio_card->curr_wr_port);
+        }
+
+        for (i = 0; i < adapter->priv_num; i++) {
+                if (!adapter->priv[i] || !adapter->priv[i]->netdev)
+                        continue;
+                priv = adapter->priv[i];
+                p += sprintf(p, "\n[interface  : \"%s\"]\n",
+                             priv->netdev->name);
+                p += sprintf(p, "wmm_tx_pending[0] = %d\n",
+                             atomic_read(&priv->wmm_tx_pending[0]));
+                p += sprintf(p, "wmm_tx_pending[1] = %d\n",
+                             atomic_read(&priv->wmm_tx_pending[1]));
+                p += sprintf(p, "wmm_tx_pending[2] = %d\n",
+                             atomic_read(&priv->wmm_tx_pending[2]));
+                p += sprintf(p, "wmm_tx_pending[3] = %d\n",
+                             atomic_read(&priv->wmm_tx_pending[3]));
+                p += sprintf(p, "media_state=\"%s\"\n", !priv->media_connected ?
+                             "Disconnected" : "Connected");
+                p += sprintf(p, "carrier %s\n", (netif_carrier_ok(priv->netdev)
+                             ? "on" : "off"));
+                for (idx = 0; idx < priv->netdev->num_tx_queues; idx++) {
+                        txq = netdev_get_tx_queue(priv->netdev, idx);
+                        p += sprintf(p, "tx queue %d:%s  ", idx,
+                                     netif_tx_queue_stopped(txq) ?
+                                     "stopped" : "started");
+                }
+                p += sprintf(p, "\n%s: num_tx_timeout = %d\n",
+                             priv->netdev->name, priv->num_tx_timeout);
+        }
+
+        if (adapter->iface_type == MWIFIEX_SDIO) {
+                p += sprintf(p, "\n=== SDIO register DUMP===\n");
+                if (adapter->if_ops.reg_dump)
+                        p += adapter->if_ops.reg_dump(adapter, p);
+        }
+
+        p += sprintf(p, "\n=== MORE DEBUG INFORMATION\n");
+        debug_info = kzalloc(sizeof(*debug_info), GFP_KERNEL);
+        if (debug_info) {
+                for (i = 0; i < adapter->priv_num; i++) {
+                        if (!adapter->priv[i] || !adapter->priv[i]->netdev)
+                                continue;
+                        priv = adapter->priv[i];
+                        mwifiex_get_debug_info(priv, debug_info);
+                        p += mwifiex_debug_info_to_buffer(priv, p, debug_info);
+                        break;
+                }
+                kfree(debug_info);
+        }
+
+        adapter->drv_info_size = p - adapter->drv_info_dump;
+        dev_info(adapter->dev, "=== DRIVER INFO DUMP END===\n");
+}
+EXPORT_SYMBOL_GPL(mwifiex_dump_drv_info);
+
 /*
  * CFG802.11 network device handler for statistics retrieval.
  */
@@ -847,26 +956,34 @@ static const struct net_device_ops mwifiex_netdev_ops = {
  *      - Nick name             : Set to null
  *      - Number of Tx timeout  : Set to 0
  *      - Device address        : Set to current address
+ *      - Rx histogram statistc : Set to 0
  *
  * In addition, the CFG80211 work queue is also created.
  */
 void mwifiex_init_priv_params(struct mwifiex_private *priv,
-                                                struct net_device *dev)
+                              struct net_device *dev)
 {
         dev->netdev_ops = &mwifiex_netdev_ops;
         dev->destructor = free_netdev;
         /* Initialize private structure */
         priv->current_key_index = 0;
         priv->media_connected = false;
-        memset(&priv->nick_name, 0, sizeof(priv->nick_name));
         memset(priv->mgmt_ie, 0,
                sizeof(struct mwifiex_ie) * MAX_MGMT_IE_INDEX);
         priv->beacon_idx = MWIFIEX_AUTO_IDX_MASK;
         priv->proberesp_idx = MWIFIEX_AUTO_IDX_MASK;
         priv->assocresp_idx = MWIFIEX_AUTO_IDX_MASK;
-        priv->rsn_idx = MWIFIEX_AUTO_IDX_MASK;
+        priv->gen_idx = MWIFIEX_AUTO_IDX_MASK;
         priv->num_tx_timeout = 0;
+        ether_addr_copy(priv->curr_addr, priv->adapter->perm_addr);
         memcpy(dev->dev_addr, priv->curr_addr, ETH_ALEN);
+
+        if (GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_STA ||
+            GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_UAP) {
+                priv->hist_data = kmalloc(sizeof(*priv->hist_data), GFP_KERNEL);
+                if (priv->hist_data)
+                        mwifiex_hist_data_reset(priv);
+        }
 }
 
 /*
@@ -1000,8 +1117,7 @@ err_init_fw:
         pr_debug("info: %s: unregister device\n", __func__);
         if (adapter->if_ops.unregister_dev)
                 adapter->if_ops.unregister_dev(adapter);
-        if ((adapter->hw_status == MWIFIEX_HW_STATUS_FW_READY) ||
-            (adapter->hw_status == MWIFIEX_HW_STATUS_READY)) {
+        if (adapter->hw_status == MWIFIEX_HW_STATUS_READY) {
                 pr_debug("info: %s: shutdown mwifiex\n", __func__);
                 adapter->init_wait_q_woken = false;
 
@@ -1052,6 +1168,8 @@ int mwifiex_remove_card(struct mwifiex_adapter *adapter, struct semaphore *sem)
 
         adapter->surprise_removed = true;
 
+        mwifiex_terminate_workqueue(adapter);
+
         /* Stop data */
         for (i = 0; i < adapter->priv_num; i++) {
                 priv = adapter->priv[i];
@@ -1086,16 +1204,15 @@ int mwifiex_remove_card(struct mwifiex_adapter *adapter, struct semaphore *sem)
                         continue;
 
                 rtnl_lock();
-                if (priv->wdev && priv->netdev)
-                        mwifiex_del_virtual_intf(adapter->wiphy, priv->wdev);
+                if (priv->netdev &&
+                    priv->wdev.iftype != NL80211_IFTYPE_UNSPECIFIED)
+                        mwifiex_del_virtual_intf(adapter->wiphy, &priv->wdev);
                 rtnl_unlock();
         }
 
         wiphy_unregister(adapter->wiphy);
         wiphy_free(adapter->wiphy);
 
-        mwifiex_terminate_workqueue(adapter);
-
         /* Unregister device */
         dev_dbg(adapter->dev, "info: unregister device\n");
         if (adapter->if_ops.unregister_dev)
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index e66993cb5daf..f0a6af179af0 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -41,6 +41,8 @@
 #include "util.h"
 #include "fw.h"
 #include "pcie.h"
+#include "usb.h"
+#include "sdio.h"
 
 extern const char driver_version[];
 
@@ -136,6 +138,8 @@ enum {
 /* Threshold for tx_timeout_cnt before we trigger a card reset */
 #define TX_TIMEOUT_THRESHOLD    6
 
+#define MWIFIEX_DRV_INFO_SIZE_MAX 0x40000
+
 struct mwifiex_dbg {
         u32 num_cmd_host_to_card_failure;
         u32 num_cmd_sleep_cfm_host_to_card_failure;
@@ -161,7 +165,6 @@ struct mwifiex_dbg {
 enum MWIFIEX_HARDWARE_STATUS {
         MWIFIEX_HW_STATUS_READY,
         MWIFIEX_HW_STATUS_INITIALIZING,
-        MWIFIEX_HW_STATUS_FW_READY,
         MWIFIEX_HW_STATUS_INIT_DONE,
         MWIFIEX_HW_STATUS_RESET,
         MWIFIEX_HW_STATUS_CLOSING,
@@ -413,6 +416,7 @@ struct mwifiex_roc_cfg {
 };
 
 #define MWIFIEX_FW_DUMP_IDX             0xff
+#define MWIFIEX_DRV_INFO_IDX            20
 #define FW_DUMP_MAX_NAME_LEN            8
 #define FW_DUMP_HOST_READY              0xEE
 #define FW_DUMP_DONE                    0xFF
@@ -543,13 +547,12 @@ struct mwifiex_private {
         u32 curr_bcn_size;
         /* spin lock for beacon buffer */
         spinlock_t curr_bcn_buf_lock;
-        struct wireless_dev *wdev;
+        struct wireless_dev wdev;
         struct mwifiex_chan_freq_power cfp;
         char version_str[128];
 #ifdef CONFIG_DEBUG_FS
         struct dentry *dfs_dev_dir;
 #endif
-        u8 nick_name[16];
         u16 current_key_index;
         struct semaphore async_sem;
         struct cfg80211_scan_request *scan_request;
@@ -564,7 +567,7 @@ struct mwifiex_private {
         u16 beacon_idx;
         u16 proberesp_idx;
         u16 assocresp_idx;
-        u16 rsn_idx;
+        u16 gen_idx;
         u8 ap_11n_enabled;
         u8 ap_11ac_enabled;
         u32 mgmt_frame_mask;
@@ -574,6 +577,7 @@ struct mwifiex_private {
         unsigned long csa_expire_time;
         u8 del_list_idx;
         bool hs2_enabled;
+        struct mwifiex_uap_bss_param bss_cfg;
         struct station_parameters *sta_params;
         struct sk_buff_head tdls_txq;
         u8 check_tdls_tx;
@@ -582,6 +586,16 @@ struct mwifiex_private {
         struct idr ack_status_frames;
         /* spin lock for ack status */
         spinlock_t ack_status_lock;
+        /** rx histogram data */
+        struct mwifiex_histogram_data *hist_data;
+        struct cfg80211_chan_def dfs_chandef;
+        struct workqueue_struct *dfs_cac_workqueue;
+        struct delayed_work dfs_cac_work;
+        struct timer_list dfs_chan_switch_timer;
+        struct workqueue_struct *dfs_chan_sw_workqueue;
+        struct delayed_work dfs_chan_sw_work;
+        struct cfg80211_beacon_data beacon_after;
+        struct mwifiex_11h_intf_state state_11h;
 };
 
 enum mwifiex_ba_status {
@@ -717,6 +731,7 @@ struct mwifiex_if_ops {
         int (*dnld_fw) (struct mwifiex_adapter *, struct mwifiex_fw_image *);
         void (*card_reset) (struct mwifiex_adapter *);
         void (*fw_dump)(struct mwifiex_adapter *);
+        int (*reg_dump)(struct mwifiex_adapter *, char *);
         int (*clean_pcie_ring) (struct mwifiex_adapter *adapter);
         void (*iface_work)(struct work_struct *work);
         void (*submit_rem_rx_urbs)(struct mwifiex_adapter *adapter);
@@ -724,6 +739,8 @@ struct mwifiex_if_ops {
 
 struct mwifiex_adapter {
         u8 iface_type;
+        struct mwifiex_iface_comb iface_limit;
+        struct mwifiex_iface_comb curr_iface_comb;
         struct mwifiex_private *priv[MWIFIEX_MAX_BSS_NUM];
         u8 priv_num;
         const struct firmware *firmware;
@@ -731,6 +748,7 @@ struct mwifiex_adapter {
         int winner;
         struct device *dev;
         struct wiphy *wiphy;
+        u8 perm_addr[ETH_ALEN];
         bool surprise_removed;
         u32 fw_release_number;
         u16 init_wait_q_woken;
@@ -744,6 +762,8 @@ struct mwifiex_adapter {
         struct work_struct main_work;
         struct workqueue_struct *rx_workqueue;
         struct work_struct rx_work;
+        struct workqueue_struct *dfs_workqueue;
+        struct work_struct dfs_work;
         bool rx_work_enabled;
         bool rx_processing;
         bool delay_main_work;
@@ -823,6 +843,7 @@ struct mwifiex_adapter {
         u16 gen_null_pkt;
         u16 pps_uapsd_mode;
         u32 pm_wakeup_fw_try;
+        struct timer_list wakeup_timer;
         u8 is_hs_configured;
         struct mwifiex_hs_config_param hs_cfg;
         u8 hs_activated;
@@ -865,6 +886,8 @@ struct mwifiex_adapter {
         struct memory_type_mapping *mem_type_mapping_tbl;
         u8 num_mem_types;
         u8 curr_mem_idx;
+        void *drv_info_dump;
+        u32 drv_info_size;
         bool scan_chan_gap_enabled;
         struct sk_buff_head rx_data_q;
         struct mwifiex_chan_stats *chan_stats;
@@ -979,7 +1002,7 @@ void mwifiex_wmm_del_peer_ra_list(struct mwifiex_private *priv,
                                   const u8 *ra_addr);
 void *mwifiex_process_sta_txpd(struct mwifiex_private *, struct sk_buff *skb);
 void *mwifiex_process_uap_txpd(struct mwifiex_private *, struct sk_buff *skb);
-int mwifiex_sta_init_cmd(struct mwifiex_private *, u8 first_sta);
+int mwifiex_sta_init_cmd(struct mwifiex_private *, u8 first_sta, bool init);
 int mwifiex_cmd_802_11_scan(struct host_cmd_ds_command *cmd,
                             struct mwifiex_scan_cmd_config *scan_cfg);
 void mwifiex_queue_scan_cmd(struct mwifiex_private *priv,
@@ -1140,6 +1163,25 @@ mwifiex_get_priv(struct mwifiex_adapter *adapter,
 }
 
 /*
+ * This function returns the first available unused private structure pointer.
+ */
+static inline struct mwifiex_private *
+mwifiex_get_unused_priv(struct mwifiex_adapter *adapter)
+{
+        int i;
+
+        for (i = 0; i < adapter->priv_num; i++) {
+                if (adapter->priv[i]) {
+                        if (adapter->priv[i]->bss_mode ==
+                            NL80211_IFTYPE_UNSPECIFIED)
+                                break;
+                }
+        }
+
+        return ((i < adapter->priv_num) ? adapter->priv[i] : NULL);
+}
+
+/*
  * This function returns the driver private structure of a network device.
  */
 static inline struct mwifiex_private *
@@ -1230,8 +1272,6 @@ int mwifiex_remain_on_chan_cfg(struct mwifiex_private *priv, u16 action,
                                struct ieee80211_channel *chan,
                                unsigned int duration);
 
-int mwifiex_set_bss_role(struct mwifiex_private *priv, u8 bss_role);
-
 int mwifiex_get_stats_info(struct mwifiex_private *priv,
                            struct mwifiex_ds_get_stats *log);
 
@@ -1291,9 +1331,17 @@ int mwifiex_set_mgmt_ies(struct mwifiex_private *priv,
                          struct cfg80211_beacon_data *data);
 int mwifiex_del_mgmt_ies(struct mwifiex_private *priv);
 u8 *mwifiex_11d_code_2_region(u8 code);
+void mwifiex_uap_set_channel(struct mwifiex_uap_bss_param *bss_cfg,
+                             struct cfg80211_chan_def chandef);
+int mwifiex_config_start_uap(struct mwifiex_private *priv,
+                             struct mwifiex_uap_bss_param *bss_cfg);
 void mwifiex_uap_del_sta_data(struct mwifiex_private *priv,
                               struct mwifiex_sta_node *node);
 
+void mwifiex_init_11h_params(struct mwifiex_private *priv);
+int mwifiex_is_11h_active(struct mwifiex_private *priv);
+int mwifiex_11h_activate(struct mwifiex_private *priv, bool flag);
+
 void mwifiex_11h_process_join(struct mwifiex_private *priv, u8 **buffer,
                               struct mwifiex_bssdescriptor *bss_desc);
 int mwifiex_11h_handle_event_chanswann(struct mwifiex_private *priv);
@@ -1324,6 +1372,8 @@ void mwifiex_process_tdls_action_frame(struct mwifiex_private *priv,
                                        u8 *buf, int len);
 int mwifiex_tdls_oper(struct mwifiex_private *priv, const u8 *peer, u8 action);
 int mwifiex_get_tdls_link_status(struct mwifiex_private *priv, const u8 *mac);
+int mwifiex_get_tdls_list(struct mwifiex_private *priv,
+                          struct tdls_peer_info *buf);
 void mwifiex_disable_all_tdls_links(struct mwifiex_private *priv);
 bool mwifiex_is_bss_in_11ac_mode(struct mwifiex_private *priv);
 u8 mwifiex_get_center_freq_index(struct mwifiex_private *priv, u8 band,
@@ -1340,6 +1390,11 @@ void mwifiex_check_auto_tdls(unsigned long context);
 void mwifiex_add_auto_tdls_peer(struct mwifiex_private *priv, const u8 *mac);
 void mwifiex_setup_auto_tdls_timer(struct mwifiex_private *priv);
 void mwifiex_clean_auto_tdls(struct mwifiex_private *priv);
+int mwifiex_cmd_issue_chan_report_request(struct mwifiex_private *priv,
+                                          struct host_cmd_ds_command *cmd,
+                                          void *data_buf);
+int mwifiex_11h_handle_chanrpt_ready(struct mwifiex_private *priv,
+                                     struct sk_buff *skb);
 
 void mwifiex_parse_tx_status_event(struct mwifiex_private *priv,
                                    void *event_body);
@@ -1347,6 +1402,21 @@ void mwifiex_parse_tx_status_event(struct mwifiex_private *priv,
 struct sk_buff *
 mwifiex_clone_skb_for_tx_status(struct mwifiex_private *priv,
                                 struct sk_buff *skb, u8 flag, u64 *cookie);
+void mwifiex_dfs_cac_work_queue(struct work_struct *work);
+void mwifiex_dfs_chan_sw_work_queue(struct work_struct *work);
+void mwifiex_abort_cac(struct mwifiex_private *priv);
+int mwifiex_11h_handle_radar_detected(struct mwifiex_private *priv,
+                                      struct sk_buff *skb);
+
+void mwifiex_hist_data_set(struct mwifiex_private *priv, u8 rx_rate, s8 snr,
+                           s8 nflr);
+void mwifiex_hist_data_reset(struct mwifiex_private *priv);
+void mwifiex_hist_data_add(struct mwifiex_private *priv,
+                           u8 rx_rate, s8 snr, s8 nflr);
+u8 mwifiex_adjust_data_rate(struct mwifiex_private *priv,
+                            u8 rx_rate, u8 ht_info);
+
+void mwifiex_dump_drv_info(struct mwifiex_adapter *adapter);
 
 #ifdef CONFIG_DEBUG_FS
 void mwifiex_debugfs_init(void);
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index c3a20f94f3c9..a5828da59365 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -204,6 +204,7 @@ static int mwifiex_pcie_probe(struct pci_dev *pdev,
                 card->pcie.blksz_fw_dl = data->blksz_fw_dl;
                 card->pcie.tx_buf_size = data->tx_buf_size;
                 card->pcie.supports_fw_dump = data->supports_fw_dump;
+                card->pcie.can_ext_scan = data->can_ext_scan;
         }
 
         if (mwifiex_add_card(card, &add_remove_card_sem, &pcie_ops,
@@ -1952,8 +1953,8 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
                 offset += txlen;
         } while (true);
 
-        dev_dbg(adapter->dev, "info:\nFW download over, size %d bytes\n",
-                offset);
+        dev_notice(adapter->dev,
+                   "info: FW download over, size %d bytes\n", offset);
 
         ret = 0;
 
@@ -2064,6 +2065,7 @@ static void mwifiex_interrupt_status(struct mwifiex_adapter *adapter)
                                  * state until cookie is set */
                                 adapter->ps_state = PS_STATE_AWAKE;
                                 adapter->pm_wakeup_fw_try = false;
+                                del_timer(&adapter->wakeup_timer);
                 }
         }
 }
@@ -2562,6 +2564,7 @@ static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
         adapter->mem_type_mapping_tbl = mem_type_mapping_tbl;
         adapter->num_mem_types = ARRAY_SIZE(mem_type_mapping_tbl);
         strcpy(adapter->fw_name, card->pcie.firmware);
+        adapter->ext_scan = card->pcie.can_ext_scan;
 
         return 0;
 }
diff --git a/drivers/net/wireless/mwifiex/pcie.h b/drivers/net/wireless/mwifiex/pcie.h
index 200e8b0cb582..666d40e9dbc3 100644
--- a/drivers/net/wireless/mwifiex/pcie.h
+++ b/drivers/net/wireless/mwifiex/pcie.h
@@ -206,6 +206,7 @@ struct mwifiex_pcie_device {
         u16 blksz_fw_dl;
         u16 tx_buf_size;
         bool supports_fw_dump;
+        bool can_ext_scan;
 };
 
 static const struct mwifiex_pcie_device mwifiex_pcie8766 = {
@@ -214,6 +215,7 @@ static const struct mwifiex_pcie_device mwifiex_pcie8766 = {
         .blksz_fw_dl = MWIFIEX_PCIE_BLOCK_SIZE_FW_DNLD,
         .tx_buf_size = MWIFIEX_TX_DATA_BUF_SIZE_2K,
         .supports_fw_dump = false,
+        .can_ext_scan = true,
 };
 
 static const struct mwifiex_pcie_device mwifiex_pcie8897 = {
@@ -222,6 +224,7 @@ static const struct mwifiex_pcie_device mwifiex_pcie8897 = {
         .blksz_fw_dl = MWIFIEX_PCIE_BLOCK_SIZE_FW_DNLD,
         .tx_buf_size = MWIFIEX_TX_DATA_BUF_SIZE_4K,
         .supports_fw_dump = true,
+        .can_ext_scan = true,
 };
 
 struct mwifiex_evt_buf_desc {
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index 984a7a4fa93b..0ffdb7c5afd2 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -496,10 +496,10 @@ mwifiex_scan_create_channel_list(struct mwifiex_private *priv,
 
         for (band = 0; (band < IEEE80211_NUM_BANDS) ; band++) {
 
-                if (!priv->wdev->wiphy->bands[band])
+                if (!priv->wdev.wiphy->bands[band])
                         continue;
 
-                sband = priv->wdev->wiphy->bands[band];
+                sband = priv->wdev.wiphy->bands[band];
 
                 for (i = 0; (i < sband->n_channels) ; i++) {
                         ch = &sband->channels[i];
@@ -1429,6 +1429,12 @@ int mwifiex_scan_networks(struct mwifiex_private *priv,
                 return -EBUSY;
         }
 
+        if (adapter->surprise_removed || adapter->is_cmd_timedout) {
+                dev_err(adapter->dev,
+                        "Ignore scan. Card removed or firmware in bad state\n");
+                return -EFAULT;
+        }
+
         spin_lock_irqsave(&adapter->mwifiex_cmd_lock, flags);
         adapter->scan_processing = true;
         spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, flags);
@@ -1727,10 +1733,10 @@ mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info,
 
                 freq = cfp ? cfp->freq : 0;
 
-                chan = ieee80211_get_channel(priv->wdev->wiphy, freq);
+                chan = ieee80211_get_channel(priv->wdev.wiphy, freq);
 
                 if (chan && !(chan->flags & IEEE80211_CHAN_DISABLED)) {
-                        bss = cfg80211_inform_bss(priv->wdev->wiphy,
+                        bss = cfg80211_inform_bss(priv->wdev.wiphy,
                                             chan, CFG80211_BSS_FTYPE_UNKNOWN,
                                             bssid, timestamp,
                                             cap_info_bitmap, beacon_period,
@@ -1742,7 +1748,7 @@ mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info,
                             !memcmp(bssid, priv->curr_bss_params.bss_descriptor
                                     .mac_address, ETH_ALEN))
                                 mwifiex_update_curr_bss_params(priv, bss);
-                        cfg80211_put_bss(priv->wdev->wiphy, bss);
+                        cfg80211_put_bss(priv->wdev.wiphy, bss);
                 }
         } else {
                 dev_dbg(adapter->dev, "missing BSS channel IE\n");
diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
index 933dae137850..91e36cda9543 100644
--- a/drivers/net/wireless/mwifiex/sdio.c
+++ b/drivers/net/wireless/mwifiex/sdio.c
@@ -107,6 +107,7 @@ mwifiex_sdio_probe(struct sdio_func *func, const struct sdio_device_id *id)
                 card->mp_rx_agg_buf_size = data->mp_rx_agg_buf_size;
                 card->supports_fw_dump = data->supports_fw_dump;
                 card->auto_tdls = data->auto_tdls;
+                card->can_ext_scan = data->can_ext_scan;
         }
 
         sdio_claim_host(func);
@@ -282,6 +283,9 @@ static int mwifiex_sdio_suspend(struct device *dev)
 #define SDIO_DEVICE_ID_MARVELL_8897   (0x912d)
 /* Device ID for SD8887 */
 #define SDIO_DEVICE_ID_MARVELL_8887   (0x9135)
+/* Device ID for SD8801 */
+#define SDIO_DEVICE_ID_MARVELL_8801   (0x9139)
+
 
 /* WLAN IDs */
 static const struct sdio_device_id mwifiex_ids[] = {
@@ -295,6 +299,8 @@ static const struct sdio_device_id mwifiex_ids[] = {
                 .driver_data = (unsigned long) &mwifiex_sdio_sd8897},
         {SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL, SDIO_DEVICE_ID_MARVELL_8887),
                 .driver_data = (unsigned long)&mwifiex_sdio_sd8887},
+        {SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL, SDIO_DEVICE_ID_MARVELL_8801),
+                .driver_data = (unsigned long)&mwifiex_sdio_sd8801},
         {},
 };
 
@@ -986,8 +992,8 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
                 offset += txlen;
         } while (true);
 
-        dev_dbg(adapter->dev, "info: FW download over, size %d bytes\n",
-                offset);
+        dev_notice(adapter->dev,
+                   "info: FW download over, size %d bytes\n", offset);
 
         ret = 0;
 done:
@@ -1882,6 +1888,7 @@ static int mwifiex_init_sdio(struct mwifiex_adapter *adapter)
         }
 
         adapter->auto_tdls = card->auto_tdls;
+        adapter->ext_scan = card->can_ext_scan;
         return ret;
 }
 
@@ -1958,8 +1965,8 @@ static void mwifiex_sdio_card_reset_work(struct mwifiex_adapter *adapter)
 
         pr_err("Resetting card...\n");
         mmc_remove_host(target);
-        /* 20ms delay is based on experiment with sdhci controller */
-        mdelay(20);
+        /* 200ms delay is based on experiment with sdhci controller */
+        mdelay(200);
         target->rescan_entered = 0; /* rescan non-removable cards */
         mmc_add_host(target);
 }
@@ -2023,6 +2030,8 @@ static void mwifiex_sdio_fw_dump_work(struct work_struct *work)
         u32 memory_size;
         static char *env[] = { "DRIVER=mwifiex_sdio", "EVENT=fw_dump", NULL };
 
+        mwifiex_dump_drv_info(adapter);
+
         if (!card->supports_fw_dump)
                 return;
 
@@ -2166,6 +2175,99 @@ static void mwifiex_sdio_fw_dump(struct mwifiex_adapter *adapter)
         schedule_work(&adapter->iface_work);
 }
 
+/* Function to dump SDIO function registers and SDIO scratch registers in case
+ * of FW crash
+ */
+static int
+mwifiex_sdio_reg_dump(struct mwifiex_adapter *adapter, char *drv_buf)
+{
+        char *p = drv_buf;
+        struct sdio_mmc_card *cardp = adapter->card;
+        int ret = 0;
+        u8 count, func, data, index = 0, size = 0;
+        u8 reg, reg_start, reg_end;
+        char buf[256], *ptr;
+
+        if (!p)
+                return 0;
+
+        dev_info(adapter->dev, "SDIO register DUMP START\n");
+
+        mwifiex_pm_wakeup_card(adapter);
+
+        sdio_claim_host(cardp->func);
+
+        for (count = 0; count < 5; count++) {
+                memset(buf, 0, sizeof(buf));
+                ptr = buf;
+
+                switch (count) {
+                case 0:
+                        /* Read the registers of SDIO function0 */
+                        func = count;
+                        reg_start = 0;
+                        reg_end = 9;
+                        break;
+                case 1:
+                        /* Read the registers of SDIO function1 */
+                        func = count;
+                        reg_start = cardp->reg->func1_dump_reg_start;
+                        reg_end = cardp->reg->func1_dump_reg_end;
+                        break;
+                case 2:
+                        index = 0;
+                        func = 1;
+                        reg_start = cardp->reg->func1_spec_reg_table[index++];
+                        size = cardp->reg->func1_spec_reg_num;
+                        reg_end = cardp->reg->func1_spec_reg_table[size-1];
+                        break;
+                default:
+                        /* Read the scratch registers of SDIO function1 */
+                        if (count == 4)
+                                mdelay(100);
+                        func = 1;
+                        reg_start = cardp->reg->func1_scratch_reg;
+                        reg_end = reg_start + MWIFIEX_SDIO_SCRATCH_SIZE;
+                }
+
+                if (count != 2)
+                        ptr += sprintf(ptr, "SDIO Func%d (%#x-%#x): ",
+                                       func, reg_start, reg_end);
+                else
+                        ptr += sprintf(ptr, "SDIO Func%d: ", func);
+
+                for (reg = reg_start; reg <= reg_end;) {
+                        if (func == 0)
+                                data = sdio_f0_readb(cardp->func, reg, &ret);
+                        else
+                                data = sdio_readb(cardp->func, reg, &ret);
+
+                        if (count == 2)
+                                ptr += sprintf(ptr, "(%#x) ", reg);
+                        if (!ret) {
+                                ptr += sprintf(ptr, "%02x ", data);
+                        } else {
+                                ptr += sprintf(ptr, "ERR");
+                                break;
+                        }
+
+                        if (count == 2 && reg < reg_end)
+                                reg = cardp->reg->func1_spec_reg_table[index++];
+                        else
+                                reg++;
+                }
+
+                dev_info(adapter->dev, "%s\n", buf);
+                p += sprintf(p, "%s\n", buf);
+        }
+
+        sdio_release_host(cardp->func);
+
+        dev_info(adapter->dev, "SDIO register DUMP END\n");
+
+        return p - drv_buf;
+}
+
 static struct mwifiex_if_ops sdio_ops = {
         .init_if = mwifiex_init_sdio,
         .cleanup_if = mwifiex_cleanup_sdio,
@@ -2188,6 +2290,7 @@ static struct mwifiex_if_ops sdio_ops = {
         .card_reset = mwifiex_sdio_card_reset,
         .iface_work = mwifiex_sdio_work,
         .fw_dump = mwifiex_sdio_fw_dump,
+        .reg_dump = mwifiex_sdio_reg_dump,
 };
 
 /*
diff --git a/drivers/net/wireless/mwifiex/sdio.h b/drivers/net/wireless/mwifiex/sdio.h
index 54c07156dd78..957cca246618 100644
--- a/drivers/net/wireless/mwifiex/sdio.h
+++ b/drivers/net/wireless/mwifiex/sdio.h
@@ -34,6 +34,7 @@
 #define SD8797_DEFAULT_FW_NAME "mrvl/sd8797_uapsta.bin"
 #define SD8897_DEFAULT_FW_NAME "mrvl/sd8897_uapsta.bin"
 #define SD8887_DEFAULT_FW_NAME "mrvl/sd8887_uapsta.bin"
+#define SD8801_DEFAULT_FW_NAME "mrvl/sd8801_uapsta.bin"
 
 #define BLOCK_MODE      1
 #define BYTE_MODE       0
@@ -44,6 +45,9 @@
 
 #define MWIFIEX_SDIO_BYTE_MODE_MASK     0x80000000
 
+#define MWIFIEX_MAX_FUNC2_REG_NUM       13
+#define MWIFIEX_SDIO_SCRATCH_SIZE       10
+
 #define SDIO_MPA_ADDR_BASE              0x1000
 #define CTRL_PORT                       0
 #define CTRL_PORT_MASK                  0x0001
@@ -219,6 +223,11 @@ struct mwifiex_sdio_card_reg {
         u8 fw_dump_ctrl;
         u8 fw_dump_start;
         u8 fw_dump_end;
+        u8 func1_dump_reg_start;
+        u8 func1_dump_reg_end;
+        u8 func1_scratch_reg;
+        u8 func1_spec_reg_num;
+        u8 func1_spec_reg_table[MWIFIEX_MAX_FUNC2_REG_NUM];
 };
 
 struct sdio_mmc_card {
@@ -247,6 +256,7 @@ struct sdio_mmc_card {
 
         u8 *mp_regs;
         u8 auto_tdls;
+        bool can_ext_scan;
 
         struct mwifiex_sdio_mpa_tx mpa_tx;
         struct mwifiex_sdio_mpa_rx mpa_rx;
@@ -264,6 +274,7 @@ struct mwifiex_sdio_device {
         u32 mp_tx_agg_buf_size;
         u32 mp_rx_agg_buf_size;
         u8 auto_tdls;
+        bool can_ext_scan;
 };
 
 static const struct mwifiex_sdio_card_reg mwifiex_reg_sd87xx = {
@@ -291,6 +302,11 @@ static const struct mwifiex_sdio_card_reg mwifiex_reg_sd87xx = {
         .rd_len_p0_l = 0x08,
         .rd_len_p0_u = 0x09,
         .card_misc_cfg_reg = 0x6c,
+        .func1_dump_reg_start = 0x0,
+        .func1_dump_reg_end = 0x9,
+        .func1_scratch_reg = 0x60,
+        .func1_spec_reg_num = 5,
+        .func1_spec_reg_table = {0x28, 0x30, 0x34, 0x38, 0x3c},
 };
 
 static const struct mwifiex_sdio_card_reg mwifiex_reg_sd8897 = {
@@ -335,6 +351,12 @@ static const struct mwifiex_sdio_card_reg mwifiex_reg_sd8897 = {
         .fw_dump_ctrl = 0xe2,
         .fw_dump_start = 0xe3,
         .fw_dump_end = 0xea,
+        .func1_dump_reg_start = 0x0,
+        .func1_dump_reg_end = 0xb,
+        .func1_scratch_reg = 0xc0,
+        .func1_spec_reg_num = 8,
+        .func1_spec_reg_table = {0x4C, 0x50, 0x54, 0x55, 0x58,
+                                 0x59, 0x5c, 0x5d},
 };
 
 static const struct mwifiex_sdio_card_reg mwifiex_reg_sd8887 = {
@@ -376,6 +398,13 @@ static const struct mwifiex_sdio_card_reg mwifiex_reg_sd8887 = {
         .cmd_cfg_1 = 0xc5,
         .cmd_cfg_2 = 0xc6,
         .cmd_cfg_3 = 0xc7,
+        .func1_dump_reg_start = 0x10,
+        .func1_dump_reg_end = 0x17,
+        .func1_scratch_reg = 0x90,
+        .func1_spec_reg_num = 13,
+        .func1_spec_reg_table = {0x08, 0x58, 0x5C, 0x5D, 0x60,
+                                 0x61, 0x62, 0x64, 0x65, 0x66,
+                                 0x68, 0x69, 0x6a},
 };
 
 static const struct mwifiex_sdio_device mwifiex_sdio_sd8786 = {
@@ -390,6 +419,7 @@ static const struct mwifiex_sdio_device mwifiex_sdio_sd8786 = {
         .mp_rx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_16K,
         .supports_fw_dump = false,
         .auto_tdls = false,
+        .can_ext_scan = false,
 };
 
 static const struct mwifiex_sdio_device mwifiex_sdio_sd8787 = {
@@ -404,6 +434,7 @@ static const struct mwifiex_sdio_device mwifiex_sdio_sd8787 = {
         .mp_rx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_16K,
         .supports_fw_dump = false,
         .auto_tdls = false,
+        .can_ext_scan = true,
 };
 
 static const struct mwifiex_sdio_device mwifiex_sdio_sd8797 = {
@@ -418,6 +449,7 @@ static const struct mwifiex_sdio_device mwifiex_sdio_sd8797 = {
         .mp_rx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_16K,
         .supports_fw_dump = false,
         .auto_tdls = false,
+        .can_ext_scan = true,
 };
 
 static const struct mwifiex_sdio_device mwifiex_sdio_sd8897 = {
@@ -432,6 +464,7 @@ static const struct mwifiex_sdio_device mwifiex_sdio_sd8897 = {
         .mp_rx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_32K,
         .supports_fw_dump = true,
         .auto_tdls = false,
+        .can_ext_scan = true,
 };
 
 static const struct mwifiex_sdio_device mwifiex_sdio_sd8887 = {
@@ -446,6 +479,22 @@ static const struct mwifiex_sdio_device mwifiex_sdio_sd8887 = {
         .mp_rx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_32K,
         .supports_fw_dump = false,
         .auto_tdls = true,
+        .can_ext_scan = true,
+};
+
+static const struct mwifiex_sdio_device mwifiex_sdio_sd8801 = {
+        .firmware = SD8801_DEFAULT_FW_NAME,
+        .reg = &mwifiex_reg_sd87xx,
+        .max_ports = 16,
+        .mp_agg_pkt_limit = 8,
+        .supports_sdio_new_mode = false,
+        .has_control_mask = true,
+        .tx_buf_size = MWIFIEX_TX_DATA_BUF_SIZE_2K,
+        .mp_tx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_16K,
+        .mp_rx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_16K,
+        .supports_fw_dump = false,
+        .auto_tdls = false,
+        .can_ext_scan = true,
 };
 
 /*
diff --git a/drivers/net/wireless/mwifiex/sta_cmd.c b/drivers/net/wireless/mwifiex/sta_cmd.c
index 1c2ca291d1f5..f7d204ffd6e9 100644
--- a/drivers/net/wireless/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/mwifiex/sta_cmd.c
@@ -26,6 +26,10 @@
 #include "11n.h"
 #include "11ac.h"
 
+static bool disable_auto_ds;
+module_param(disable_auto_ds, bool, 0);
+MODULE_PARM_DESC(disable_auto_ds,
+                 "deepsleep enabled=0(default), deepsleep disabled=1");
 /*
  * This function prepares command to set/get RSSI information.
  *
@@ -1893,6 +1897,10 @@ int mwifiex_sta_prepare_cmd(struct mwifiex_private *priv, uint16_t cmd_no,
         case HostCmd_CMD_TDLS_OPER:
                 ret = mwifiex_cmd_tdls_oper(priv, cmd_ptr, data_buf);
                 break;
+        case HostCmd_CMD_CHAN_REPORT_REQUEST:
+                ret = mwifiex_cmd_issue_chan_report_request(priv, cmd_ptr,
+                                                            data_buf);
+                break;
         default:
                 dev_err(priv->adapter->dev,
                         "PREP_CMD: unknown cmd- %#x\n", cmd_no);
@@ -1907,6 +1915,8 @@ int mwifiex_sta_prepare_cmd(struct mwifiex_private *priv, uint16_t cmd_no,
  *
  * This is called after firmware download to bring the card to
  * working state.
+ * Function is also called during reinitialization of virtual
+ * interfaces.
  *
  * The following commands are issued sequentially -
  *      - Set PCI-Express host buffer configuration (PCIE only)
@@ -1921,7 +1931,7 @@ int mwifiex_sta_prepare_cmd(struct mwifiex_private *priv, uint16_t cmd_no,
  *      - Set 11d control
  *      - Set MAC control (this must be the last command to initialize firmware)
  */
-int mwifiex_sta_init_cmd(struct mwifiex_private *priv, u8 first_sta)
+int mwifiex_sta_init_cmd(struct mwifiex_private *priv, u8 first_sta, bool init)
 {
         struct mwifiex_adapter *adapter = priv->adapter;
         int ret;
@@ -2031,7 +2041,8 @@ int mwifiex_sta_init_cmd(struct mwifiex_private *priv, u8 first_sta)
         if (ret)
                 return -1;
 
-        if (first_sta && priv->adapter->iface_type != MWIFIEX_USB &&
+        if (!disable_auto_ds &&
+            first_sta && priv->adapter->iface_type != MWIFIEX_USB &&
             priv->bss_type != MWIFIEX_BSS_TYPE_UAP) {
                 /* Enable auto deep sleep */
                 auto_ds.auto_ds = DEEP_SLEEP_ON;
@@ -2054,9 +2065,6 @@ int mwifiex_sta_init_cmd(struct mwifiex_private *priv, u8 first_sta)
                                 "11D: failed to enable 11D\n");
         }
 
-        /* set last_init_cmd before sending the command */
-        priv->adapter->last_init_cmd = HostCmd_CMD_11N_CFG;
-
         /* Send cmd to FW to configure 11n specific configuration
          * (Short GI, Channel BW, Green field support etc.) for transmit
          */
@@ -2064,7 +2072,11 @@ int mwifiex_sta_init_cmd(struct mwifiex_private *priv, u8 first_sta)
         ret = mwifiex_send_cmd(priv, HostCmd_CMD_11N_CFG,
                                HostCmd_ACT_GEN_SET, 0, &tx_cfg, true);
 
-        ret = -EINPROGRESS;
+        if (init) {
+                /* set last_init_cmd before sending the command */
+                priv->adapter->last_init_cmd = HostCmd_CMD_11N_CFG;
+                ret = -EINPROGRESS;
+        }
 
         return ret;
 }
diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c
index b65e1014b0fc..5f8da5924666 100644
--- a/drivers/net/wireless/mwifiex/sta_cmdresp.c
+++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c
@@ -248,6 +248,8 @@ static int mwifiex_ret_get_log(struct mwifiex_private *priv,
                         le32_to_cpu(get_log->wep_icv_err_cnt[2]);
                 stats->wep_icv_error[3] =
                         le32_to_cpu(get_log->wep_icv_err_cnt[3]);
+                stats->bcn_rcv_cnt = le32_to_cpu(get_log->bcn_rcv_cnt);
+                stats->bcn_miss_cnt = le32_to_cpu(get_log->bcn_miss_cnt);
         }
 
         return 0;
@@ -1103,6 +1105,9 @@ int mwifiex_process_sta_cmdresp(struct mwifiex_private *priv, u16 cmdresp_no,
         case HostCmd_CMD_UAP_SYS_CONFIG:
                 break;
         case HostCmd_CMD_UAP_BSS_START:
+                adapter->tx_lock_flag = false;
+                adapter->pps_uapsd_mode = false;
+                adapter->delay_null_pkt = false;
                 priv->bss_started = 1;
                 break;
         case HostCmd_CMD_UAP_BSS_STOP:
@@ -1117,6 +1122,8 @@ int mwifiex_process_sta_cmdresp(struct mwifiex_private *priv, u16 cmdresp_no,
         case HostCmd_CMD_TDLS_OPER:
                 ret = mwifiex_ret_tdls_oper(priv, resp);
                 break;
+        case HostCmd_CMD_CHAN_REPORT_REQUEST:
+                break;
         default:
                 dev_err(adapter->dev, "CMD_RESP: unknown cmd response %#x\n",
                         resp->command);
diff --git a/drivers/net/wireless/mwifiex/sta_event.c b/drivers/net/wireless/mwifiex/sta_event.c
index b8c171df6223..80ffe7412496 100644
--- a/drivers/net/wireless/mwifiex/sta_event.c
+++ b/drivers/net/wireless/mwifiex/sta_event.c
@@ -90,6 +90,10 @@ mwifiex_reset_connect_state(struct mwifiex_private *priv, u16 reason_code)
         priv->is_data_rate_auto = true;
         priv->data_rate = 0;
 
+        if ((GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_STA ||
+             GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_UAP) && priv->hist_data)
+                mwifiex_hist_data_reset(priv);
+
         if (priv->bss_mode == NL80211_IFTYPE_ADHOC) {
                 priv->adhoc_state = ADHOC_IDLE;
                 priv->adhoc_is_link_sensed = false;
@@ -308,6 +312,7 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
                                         adapter->ps_state = PS_STATE_AWAKE;
                                         adapter->pm_wakeup_card_req = false;
                                         adapter->pm_wakeup_fw_try = false;
+                                        del_timer_sync(&adapter->wakeup_timer);
                                         break;
                                 }
                                 if (!mwifiex_send_null_packet
@@ -322,6 +327,7 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
                 adapter->ps_state = PS_STATE_AWAKE;
                 adapter->pm_wakeup_card_req = false;
                 adapter->pm_wakeup_fw_try = false;
+                del_timer_sync(&adapter->wakeup_timer);
 
                 break;
 
@@ -480,7 +486,7 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
 
         case EVENT_REMAIN_ON_CHAN_EXPIRED:
                 dev_dbg(adapter->dev, "event: Remain on channel expired\n");
-                cfg80211_remain_on_channel_expired(priv->wdev,
+                cfg80211_remain_on_channel_expired(&priv->wdev,
                                                    priv->roc_cfg.cookie,
                                                    &priv->roc_cfg.chan,
                                                    GFP_ATOMIC);
@@ -509,6 +515,16 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
                 mwifiex_parse_tx_status_event(priv, adapter->event_body);
                 break;
 
+        case EVENT_CHANNEL_REPORT_RDY:
+                dev_dbg(adapter->dev, "event: Channel Report\n");
+                ret = mwifiex_11h_handle_chanrpt_ready(priv,
+                                                       adapter->event_skb);
+                break;
+        case EVENT_RADAR_DETECTED:
+                dev_dbg(adapter->dev, "event: Radar detected\n");
+                ret = mwifiex_11h_handle_radar_detected(priv,
+                                                        adapter->event_skb);
+                break;
         default:
                 dev_dbg(adapter->dev, "event: unknown event id: %#x\n",
                         eventcause);
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index 1626868a4b5c..0599e41e253c 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -219,7 +219,7 @@ static int mwifiex_process_country_ie(struct mwifiex_private *priv,
 
         if (!strncmp(priv->adapter->country_code, &country_ie[2], 2)) {
                 rcu_read_unlock();
-                wiphy_dbg(priv->wdev->wiphy,
+                wiphy_dbg(priv->wdev.wiphy,
                           "11D: skip setting domain info in FW\n");
                 return 0;
         }
@@ -902,9 +902,12 @@ static int mwifiex_sec_ioctl_set_wep_key(struct mwifiex_private *priv,
         if (wep_key->key_length) {
                 void *enc_key;
 
-                if (encrypt_key->key_disable)
+                if (encrypt_key->key_disable) {
                         memset(&priv->wep_key[index], 0,
                                sizeof(struct mwifiex_wep_key));
+                        if (wep_key->key_length)
+                                goto done;
+                        }
 
                 if (adapter->key_api_major_ver == KEY_API_VER_MAJOR_V2)
                         enc_key = encrypt_key;
@@ -918,6 +921,7 @@ static int mwifiex_sec_ioctl_set_wep_key(struct mwifiex_private *priv,
                         return ret;
         }
 
+done:
         if (priv->sec_info.wep_enabled)
                 priv->curr_pkt_filter |= HostCmd_ACT_MAC_WEP_ENABLE;
         else
@@ -1131,36 +1135,6 @@ mwifiex_remain_on_chan_cfg(struct mwifiex_private *priv, u16 action,
         return roc_cfg.status;
 }
 
-int
-mwifiex_set_bss_role(struct mwifiex_private *priv, u8 bss_role)
-{
-        if (GET_BSS_ROLE(priv) == bss_role) {
-                dev_dbg(priv->adapter->dev,
-                        "info: already in the desired role.\n");
-                return 0;
-        }
-
-        mwifiex_free_priv(priv);
-        mwifiex_init_priv(priv);
-
-        priv->bss_role = bss_role;
-        switch (bss_role) {
-        case MWIFIEX_BSS_ROLE_UAP:
-                priv->bss_mode = NL80211_IFTYPE_AP;
-                break;
-        case MWIFIEX_BSS_ROLE_STA:
-        case MWIFIEX_BSS_ROLE_ANY:
-        default:
-                priv->bss_mode = NL80211_IFTYPE_STATION;
-                break;
-        }
-
-        mwifiex_send_cmd(priv, HostCmd_CMD_SET_BSS_MODE,
-                         HostCmd_ACT_GEN_SET, 0, NULL, true);
-
-        return mwifiex_sta_init_cmd(priv, false);
-}
-
 /*
  * Sends IOCTL request to get statistics information.
  *
diff --git a/drivers/net/wireless/mwifiex/sta_rx.c b/drivers/net/wireless/mwifiex/sta_rx.c
index c2ad3b63ae70..b8729c9394e9 100644
--- a/drivers/net/wireless/mwifiex/sta_rx.c
+++ b/drivers/net/wireless/mwifiex/sta_rx.c
@@ -90,6 +90,7 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv,
         struct ethhdr *eth;
         u16 rx_pkt_off, rx_pkt_len;
         u8 *offset;
+        u8 adj_rx_rate = 0;
 
         local_rx_pd = (struct rxpd *) (skb->data);
 
@@ -155,6 +156,14 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv,
 
         priv->rxpd_htinfo = local_rx_pd->ht_info;
 
+        if (GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_STA ||
+            GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_UAP) {
+                adj_rx_rate = mwifiex_adjust_data_rate(priv, priv->rxpd_rate,
+                                                       priv->rxpd_htinfo);
+                mwifiex_hist_data_add(priv, adj_rx_rate, local_rx_pd->snr,
+                                      local_rx_pd->nf);
+        }
+
         ret = mwifiex_recv_packet(priv, skb);
         if (ret == -1)
                 dev_err(priv->adapter->dev, "recv packet failed\n");
diff --git a/drivers/net/wireless/mwifiex/sta_tx.c b/drivers/net/wireless/mwifiex/sta_tx.c
index b896d7375b52..5ce2d9a4f919 100644
--- a/drivers/net/wireless/mwifiex/sta_tx.c
+++ b/drivers/net/wireless/mwifiex/sta_tx.c
@@ -47,8 +47,10 @@ void *mwifiex_process_sta_txpd(struct mwifiex_private *priv,
         struct mwifiex_adapter *adapter = priv->adapter;
         struct txpd *local_tx_pd;
         struct mwifiex_txinfo *tx_info = MWIFIEX_SKB_TXCB(skb);
-        u8 pad;
+        unsigned int pad;
         u16 pkt_type, pkt_offset;
+        int hroom = (priv->adapter->iface_type == MWIFIEX_USB) ? 0 :
+                       INTF_HEADER_LEN;
 
         if (!skb->len) {
                 dev_err(adapter->dev, "Tx: bad packet length: %d\n", skb->len);
@@ -56,13 +58,12 @@ void *mwifiex_process_sta_txpd(struct mwifiex_private *priv,
                 return skb->data;
         }
 
-        pkt_type = mwifiex_is_skb_mgmt_frame(skb) ? PKT_TYPE_MGMT : 0;
+        BUG_ON(skb_headroom(skb) < MWIFIEX_MIN_DATA_HEADER_LEN);
 
-        /* If skb->data is not aligned; add padding */
-        pad = (4 - (((void *)skb->data - NULL) & 0x3)) % 4;
+        pkt_type = mwifiex_is_skb_mgmt_frame(skb) ? PKT_TYPE_MGMT : 0;
 
-        BUG_ON(skb_headroom(skb) < (sizeof(*local_tx_pd) + INTF_HEADER_LEN
-                                    + pad));
+        pad = ((void *)skb->data - (sizeof(*local_tx_pd) + hroom)-
+                         NULL) & (MWIFIEX_DMA_ALIGN_SZ - 1);
         skb_push(skb, sizeof(*local_tx_pd) + pad);
 
         local_tx_pd = (struct txpd *) skb->data;
@@ -70,8 +71,8 @@ void *mwifiex_process_sta_txpd(struct mwifiex_private *priv,
         local_tx_pd->bss_num = priv->bss_num;
         local_tx_pd->bss_type = priv->bss_type;
         local_tx_pd->tx_pkt_length = cpu_to_le16((u16)(skb->len -
-                                                       (sizeof(struct txpd)
-                                                        + pad)));
+                                                       (sizeof(struct txpd) +
+                                                        pad)));
 
         local_tx_pd->priority = (u8) skb->priority;
         local_tx_pd->pkt_delay_2ms =
@@ -115,7 +116,7 @@ void *mwifiex_process_sta_txpd(struct mwifiex_private *priv,
         local_tx_pd->tx_pkt_offset = cpu_to_le16(pkt_offset);
 
         /* make space for INTF_HEADER_LEN */
-        skb_push(skb, INTF_HEADER_LEN);
+        skb_push(skb, hroom);
 
         if (!local_tx_pd->tx_control)
                 /* TxCtrl set by user or default */
@@ -182,9 +183,13 @@ int mwifiex_send_null_packet(struct mwifiex_private *priv, u8 flags)
         }
         switch (ret) {
         case -EBUSY:
-                adapter->data_sent = true;
-                /* Fall through FAILURE handling */
+                dev_kfree_skb_any(skb);
+                dev_err(adapter->dev, "%s: host_to_card failed: ret=%d\n",
+                        __func__, ret);
+                adapter->dbg.num_tx_host_to_card_failure++;
+                break;
         case -1:
+                adapter->data_sent = false;
                 dev_kfree_skb_any(skb);
                 dev_err(adapter->dev, "%s: host_to_card failed: ret=%d\n",
                         __func__, ret);
@@ -197,6 +202,7 @@ int mwifiex_send_null_packet(struct mwifiex_private *priv, u8 flags)
                 adapter->tx_lock_flag = true;
                 break;
         case -EINPROGRESS:
+                adapter->tx_lock_flag = true;
                 break;
         default:
                 break;
diff --git a/drivers/net/wireless/mwifiex/tdls.c b/drivers/net/wireless/mwifiex/tdls.c
index 22884b429be7..087d84762cd3 100644
--- a/drivers/net/wireless/mwifiex/tdls.c
+++ b/drivers/net/wireless/mwifiex/tdls.c
@@ -1123,6 +1123,36 @@ int mwifiex_get_tdls_link_status(struct mwifiex_private *priv, const u8 *mac)
         return TDLS_NOT_SETUP;
 }
 
+int mwifiex_get_tdls_list(struct mwifiex_private *priv,
+                          struct tdls_peer_info *buf)
+{
+        struct mwifiex_sta_node *sta_ptr;
+        struct tdls_peer_info *peer = buf;
+        int count = 0;
+        unsigned long flags;
+
+        if (!ISSUPP_TDLS_ENABLED(priv->adapter->fw_cap_info))
+                return 0;
+
+        /* make sure we are in station mode and connected */
+        if (!(priv->bss_type == MWIFIEX_BSS_TYPE_STA && priv->media_connected))
+                return 0;
+
+        spin_lock_irqsave(&priv->sta_list_spinlock, flags);
+        list_for_each_entry(sta_ptr, &priv->sta_list, list) {
+                if (sta_ptr->tdls_status == TDLS_SETUP_COMPLETE) {
+                        ether_addr_copy(peer->peer_addr, sta_ptr->mac_addr);
+                        peer++;
+                        count++;
+                        if (count >= MWIFIEX_MAX_TDLS_PEER_SUPPORTED)
+                                break;
+                }
+        }
+        spin_unlock_irqrestore(&priv->sta_list_spinlock, flags);
+
+        return count;
+}
+
 void mwifiex_disable_all_tdls_links(struct mwifiex_private *priv)
 {
         struct mwifiex_sta_node *sta_ptr;
@@ -1367,9 +1397,8 @@ void mwifiex_check_auto_tdls(unsigned long context)
 
 void mwifiex_setup_auto_tdls_timer(struct mwifiex_private *priv)
 {
-        init_timer(&priv->auto_tdls_timer);
-        priv->auto_tdls_timer.function = mwifiex_check_auto_tdls;
-        priv->auto_tdls_timer.data = (unsigned long)priv;
+        setup_timer(&priv->auto_tdls_timer, mwifiex_check_auto_tdls,
+                    (unsigned long)priv);
         priv->auto_tdls_timer_active = true;
         mod_timer(&priv->auto_tdls_timer,
                   jiffies + msecs_to_jiffies(MWIFIEX_TIMER_10S));
diff --git a/drivers/net/wireless/mwifiex/txrx.c b/drivers/net/wireless/mwifiex/txrx.c
index 6ae133333363..ac93557cbdc9 100644
--- a/drivers/net/wireless/mwifiex/txrx.c
+++ b/drivers/net/wireless/mwifiex/txrx.c
@@ -227,7 +227,7 @@ void mwifiex_parse_tx_status_event(struct mwifiex_private *priv,
                         /* consumes ack_skb */
                         skb_complete_wifi_ack(ack_skb, !tx_status->status);
                 } else {
-                        cfg80211_mgmt_tx_status(priv->wdev, tx_info->cookie,
+                        cfg80211_mgmt_tx_status(&priv->wdev, tx_info->cookie,
                                                 ack_skb->data, ack_skb->len,
                                                 !tx_status->status, GFP_ATOMIC);
                         dev_kfree_skb_any(ack_skb);
diff --git a/drivers/net/wireless/mwifiex/uap_cmd.c b/drivers/net/wireless/mwifiex/uap_cmd.c
index 0f347fdefa0a..f5c2af01ba0a 100644
--- a/drivers/net/wireless/mwifiex/uap_cmd.c
+++ b/drivers/net/wireless/mwifiex/uap_cmd.c
@@ -761,6 +761,11 @@ int mwifiex_uap_prepare_cmd(struct mwifiex_private *priv, u16 cmd_no,
                 if (mwifiex_cmd_uap_sta_deauth(priv, cmd, data_buf))
                         return -1;
                 break;
+        case HostCmd_CMD_CHAN_REPORT_REQUEST:
+                if (mwifiex_cmd_issue_chan_report_request(priv, cmd_buf,
+                                                          data_buf))
+                        return -1;
+                break;
         default:
                 dev_err(priv->adapter->dev,
                         "PREP_CMD: unknown cmd %#x\n", cmd_no);
@@ -769,3 +774,68 @@ int mwifiex_uap_prepare_cmd(struct mwifiex_private *priv, u16 cmd_no,
 
         return 0;
 }
+
+void mwifiex_uap_set_channel(struct mwifiex_uap_bss_param *bss_cfg,
+                             struct cfg80211_chan_def chandef)
+{
+        u8 config_bands = 0;
+
+        bss_cfg->channel = ieee80211_frequency_to_channel(
+                                                     chandef.chan->center_freq);
+
+        /* Set appropriate bands */
+        if (chandef.chan->band == IEEE80211_BAND_2GHZ) {
+                bss_cfg->band_cfg = BAND_CONFIG_BG;
+                config_bands = BAND_B | BAND_G;
+
+                if (chandef.width > NL80211_CHAN_WIDTH_20_NOHT)
+                        config_bands |= BAND_GN;
+        } else {
+                bss_cfg->band_cfg = BAND_CONFIG_A;
+                config_bands = BAND_A;
+
+                if (chandef.width > NL80211_CHAN_WIDTH_20_NOHT)
+                        config_bands |= BAND_AN;
+
+                if (chandef.width > NL80211_CHAN_WIDTH_40)
+                        config_bands |= BAND_AAC;
+        }
+}
+
+int mwifiex_config_start_uap(struct mwifiex_private *priv,
+                             struct mwifiex_uap_bss_param *bss_cfg)
+{
+        if (mwifiex_del_mgmt_ies(priv))
+                dev_err(priv->adapter->dev, "Failed to delete mgmt IEs!\n");
+
+        if (mwifiex_send_cmd(priv, HostCmd_CMD_UAP_BSS_STOP,
+                             HostCmd_ACT_GEN_SET, 0, NULL, true)) {
+                dev_err(priv->adapter->dev, "Failed to stop the BSS\n");
+                return -1;
+        }
+
+        if (mwifiex_send_cmd(priv, HostCmd_CMD_UAP_SYS_CONFIG,
+                             HostCmd_ACT_GEN_SET,
+                             UAP_BSS_PARAMS_I, bss_cfg, false)) {
+                dev_err(priv->adapter->dev, "Failed to set the SSID\n");
+                return -1;
+        }
+
+        if (mwifiex_send_cmd(priv, HostCmd_CMD_UAP_BSS_START,
+                             HostCmd_ACT_GEN_SET, 0, NULL, false)) {
+                dev_err(priv->adapter->dev, "Failed to start the BSS\n");
+                return -1;
+        }
+
+        if (priv->sec_info.wep_enabled)
+                priv->curr_pkt_filter |= HostCmd_ACT_MAC_WEP_ENABLE;
+        else
+                priv->curr_pkt_filter &= ~HostCmd_ACT_MAC_WEP_ENABLE;
+
+        if (mwifiex_send_cmd(priv, HostCmd_CMD_MAC_CONTROL,
+                             HostCmd_ACT_GEN_SET, 0,
+                             &priv->curr_pkt_filter, true))
+                return -1;
+
+        return 0;
+}
diff --git a/drivers/net/wireless/mwifiex/uap_event.c b/drivers/net/wireless/mwifiex/uap_event.c
index c54a537e31fb..f4794cdc36d2 100644
--- a/drivers/net/wireless/mwifiex/uap_event.c
+++ b/drivers/net/wireless/mwifiex/uap_event.c
@@ -68,7 +68,6 @@ int mwifiex_process_uap_event(struct mwifiex_private *priv)
                                 len = ETH_ALEN;
 
                         if (len != -1) {
-                                sinfo.filled = STATION_INFO_ASSOC_REQ_IES;
                                 sinfo.assoc_req_ies = &event->data[len];
                                 len = (u8 *)sinfo.assoc_req_ies -
                                       (u8 *)&event->frame_control;
@@ -132,6 +131,8 @@ int mwifiex_process_uap_event(struct mwifiex_private *priv)
                 dev_dbg(adapter->dev, "AP EVENT: event id: %#x\n", eventcause);
                 memcpy(priv->netdev->dev_addr, adapter->event_body + 2,
                        ETH_ALEN);
+                if (priv->hist_data)
+                        mwifiex_hist_data_reset(priv);
                 break;
         case EVENT_UAP_MIC_COUNTERMEASURES:
                 /* For future development */
@@ -177,6 +178,53 @@ int mwifiex_process_uap_event(struct mwifiex_private *priv)
                 dev_dbg(adapter->dev, "event: TX_STATUS Report\n");
                 mwifiex_parse_tx_status_event(priv, adapter->event_body);
                 break;
+        case EVENT_PS_SLEEP:
+                dev_dbg(adapter->dev, "info: EVENT: SLEEP\n");
+
+                adapter->ps_state = PS_STATE_PRE_SLEEP;
+
+                mwifiex_check_ps_cond(adapter);
+                break;
+
+        case EVENT_PS_AWAKE:
+                dev_dbg(adapter->dev, "info: EVENT: AWAKE\n");
+                if (!adapter->pps_uapsd_mode &&
+                    priv->media_connected && adapter->sleep_period.period) {
+                                adapter->pps_uapsd_mode = true;
+                                dev_dbg(adapter->dev,
+                                        "event: PPS/UAPSD mode activated\n");
+                }
+                adapter->tx_lock_flag = false;
+                if (adapter->pps_uapsd_mode && adapter->gen_null_pkt) {
+                        if (mwifiex_check_last_packet_indication(priv)) {
+                                if (adapter->data_sent) {
+                                        adapter->ps_state = PS_STATE_AWAKE;
+                                        adapter->pm_wakeup_card_req = false;
+                                        adapter->pm_wakeup_fw_try = false;
+                                        break;
+                                }
+                                if (!mwifiex_send_null_packet
+                                        (priv,
+                                         MWIFIEX_TxPD_POWER_MGMT_NULL_PACKET |
+                                         MWIFIEX_TxPD_POWER_MGMT_LAST_PACKET))
+                                                adapter->ps_state =
+                                                        PS_STATE_SLEEP;
+                                        return 0;
+                        }
+                }
+                adapter->ps_state = PS_STATE_AWAKE;
+                adapter->pm_wakeup_card_req = false;
+                adapter->pm_wakeup_fw_try = false;
+                break;
+
+        case EVENT_CHANNEL_REPORT_RDY:
+                dev_dbg(adapter->dev, "event: Channel Report\n");
+                mwifiex_11h_handle_chanrpt_ready(priv, adapter->event_skb);
+                break;
+        case EVENT_RADAR_DETECTED:
+                dev_dbg(adapter->dev, "event: Radar detected\n");
+                mwifiex_11h_handle_radar_detected(priv, adapter->event_skb);
+                break;
         default:
                 dev_dbg(adapter->dev, "event: unknown event id: %#x\n",
                         eventcause);
diff --git a/drivers/net/wireless/mwifiex/uap_txrx.c b/drivers/net/wireless/mwifiex/uap_txrx.c
index be3a203a529b..38ac4d74c486 100644
--- a/drivers/net/wireless/mwifiex/uap_txrx.c
+++ b/drivers/net/wireless/mwifiex/uap_txrx.c
@@ -348,8 +348,10 @@ void *mwifiex_process_uap_txpd(struct mwifiex_private *priv,
         struct mwifiex_adapter *adapter = priv->adapter;
         struct uap_txpd *txpd;
         struct mwifiex_txinfo *tx_info = MWIFIEX_SKB_TXCB(skb);
-        int pad, len;
-        u16 pkt_type;
+        int pad;
+        u16 pkt_type, pkt_offset;
+        int hroom = (priv->adapter->iface_type == MWIFIEX_USB) ? 0 :
+                       INTF_HEADER_LEN;
 
         if (!skb->len) {
                 dev_err(adapter->dev, "Tx: bad packet length: %d\n", skb->len);
@@ -357,22 +359,21 @@ void *mwifiex_process_uap_txpd(struct mwifiex_private *priv,
                 return skb->data;
         }
 
-        pkt_type = mwifiex_is_skb_mgmt_frame(skb) ? PKT_TYPE_MGMT : 0;
-
-        /* If skb->data is not aligned, add padding */
-        pad = (4 - (((void *)skb->data - NULL) & 0x3)) % 4;
+        BUG_ON(skb_headroom(skb) < MWIFIEX_MIN_DATA_HEADER_LEN);
 
-        len = sizeof(*txpd) + pad;
+        pkt_type = mwifiex_is_skb_mgmt_frame(skb) ? PKT_TYPE_MGMT : 0;
 
-        BUG_ON(skb_headroom(skb) < len + INTF_HEADER_LEN);
+        pad = ((void *)skb->data - (sizeof(*txpd) + hroom) - NULL) &
+                        (MWIFIEX_DMA_ALIGN_SZ - 1);
 
-        skb_push(skb, len);
+        skb_push(skb, sizeof(*txpd) + pad);
 
         txpd = (struct uap_txpd *)skb->data;
         memset(txpd, 0, sizeof(*txpd));
         txpd->bss_num = priv->bss_num;
         txpd->bss_type = priv->bss_type;
-        txpd->tx_pkt_length = cpu_to_le16((u16)(skb->len - len));
+        txpd->tx_pkt_length = cpu_to_le16((u16)(skb->len - (sizeof(*txpd) +
+                                                pad)));
         txpd->priority = (u8)skb->priority;
 
         txpd->pkt_delay_2ms = mwifiex_wmm_compute_drv_pkt_delay(priv, skb);
@@ -392,16 +393,17 @@ void *mwifiex_process_uap_txpd(struct mwifiex_private *priv,
                     cpu_to_le32(priv->wmm.user_pri_pkt_tx_ctrl[txpd->priority]);
 
         /* Offset of actual data */
+        pkt_offset = sizeof(*txpd) + pad;
         if (pkt_type == PKT_TYPE_MGMT) {
                 /* Set the packet type and add header for management frame */
                 txpd->tx_pkt_type = cpu_to_le16(pkt_type);
-                len += MWIFIEX_MGMT_FRAME_HEADER_SIZE;
+                pkt_offset += MWIFIEX_MGMT_FRAME_HEADER_SIZE;
         }
 
-        txpd->tx_pkt_offset = cpu_to_le16(len);
+        txpd->tx_pkt_offset = cpu_to_le16(pkt_offset);
 
         /* make space for INTF_HEADER_LEN */
-        skb_push(skb, INTF_HEADER_LEN);
+        skb_push(skb, hroom);
 
         if (!txpd->tx_control)
                 /* TxCtrl set by user or default */
diff --git a/drivers/net/wireless/mwifiex/usb.c b/drivers/net/wireless/mwifiex/usb.c
index 1b56495ec872..223873022ffe 100644
--- a/drivers/net/wireless/mwifiex/usb.c
+++ b/drivers/net/wireless/mwifiex/usb.c
@@ -37,6 +37,11 @@ static struct usb_device_id mwifiex_usb_table[] = {
         {USB_DEVICE_AND_INTERFACE_INFO(USB8XXX_VID, USB8797_PID_2,
                                        USB_CLASS_VENDOR_SPEC,
                                        USB_SUBCLASS_VENDOR_SPEC, 0xff)},
+        /* 8801 */
+        {USB_DEVICE(USB8XXX_VID, USB8801_PID_1)},
+        {USB_DEVICE_AND_INTERFACE_INFO(USB8XXX_VID, USB8801_PID_2,
+                                       USB_CLASS_VENDOR_SPEC,
+                                       USB_SUBCLASS_VENDOR_SPEC, 0xff)},
         /* 8897 */
         {USB_DEVICE(USB8XXX_VID, USB8897_PID_1)},
         {USB_DEVICE_AND_INTERFACE_INFO(USB8XXX_VID, USB8897_PID_2,
@@ -361,11 +366,13 @@ static int mwifiex_usb_probe(struct usb_interface *intf,
         switch (id_product) {
         case USB8766_PID_1:
         case USB8797_PID_1:
+        case USB8801_PID_1:
         case USB8897_PID_1:
                 card->usb_boot_state = USB8XXX_FW_DNLD;
                 break;
         case USB8766_PID_2:
         case USB8797_PID_2:
+        case USB8801_PID_2:
         case USB8897_PID_2:
                 card->usb_boot_state = USB8XXX_FW_READY;
                 break;
@@ -792,11 +799,19 @@ static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
         case USB8897_PID_2:
                 adapter->tx_buf_size = MWIFIEX_TX_DATA_BUF_SIZE_4K;
                 strcpy(adapter->fw_name, USB8897_DEFAULT_FW_NAME);
+                adapter->ext_scan = true;
                 break;
         case USB8766_PID_1:
         case USB8766_PID_2:
                 adapter->tx_buf_size = MWIFIEX_TX_DATA_BUF_SIZE_2K;
                 strcpy(adapter->fw_name, USB8766_DEFAULT_FW_NAME);
+                adapter->ext_scan = true;
+                break;
+        case USB8801_PID_1:
+        case USB8801_PID_2:
+                adapter->tx_buf_size = MWIFIEX_TX_DATA_BUF_SIZE_2K;
+                strcpy(adapter->fw_name, USB8801_DEFAULT_FW_NAME);
+                adapter->ext_scan = false;
                 break;
         case USB8797_PID_1:
         case USB8797_PID_2:
@@ -930,7 +945,8 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
         } while ((dnld_cmd != FW_HAS_LAST_BLOCK) && retries);
 
 cleanup:
-        dev_dbg(adapter->dev, "%s: %d bytes downloaded\n", __func__, tlen);
+        dev_notice(adapter->dev,
+                   "info: FW download over, size %d bytes\n", tlen);
 
         kfree(recv_buff);
         kfree(fwdata);
@@ -990,6 +1006,7 @@ static int mwifiex_pm_wakeup_card(struct mwifiex_adapter *adapter)
 {
         /* Simulation of HS_AWAKE event */
         adapter->pm_wakeup_fw_try = false;
+        del_timer_sync(&adapter->wakeup_timer);
         adapter->pm_wakeup_card_req = false;
         adapter->ps_state = PS_STATE_AWAKE;
 
@@ -1010,6 +1027,13 @@ static void mwifiex_usb_submit_rem_rx_urbs(struct mwifiex_adapter *adapter)
         }
 }
 
+/* This function is called after the card has woken up. */
+static inline int
+mwifiex_pm_wakeup_card_complete(struct mwifiex_adapter *adapter)
+{
+        return 0;
+}
+
 static struct mwifiex_if_ops usb_ops = {
         .register_dev =         mwifiex_register_dev,
         .unregister_dev =       mwifiex_unregister_dev,
@@ -1074,4 +1098,5 @@ MODULE_VERSION(USB_VERSION);
 MODULE_LICENSE("GPL v2");
 MODULE_FIRMWARE(USB8766_DEFAULT_FW_NAME);
 MODULE_FIRMWARE(USB8797_DEFAULT_FW_NAME);
+MODULE_FIRMWARE(USB8801_DEFAULT_FW_NAME);
 MODULE_FIRMWARE(USB8897_DEFAULT_FW_NAME);
diff --git a/drivers/net/wireless/mwifiex/usb.h b/drivers/net/wireless/mwifiex/usb.h
index a7cbba1355af..57e1a5736318 100644
--- a/drivers/net/wireless/mwifiex/usb.h
+++ b/drivers/net/wireless/mwifiex/usb.h
@@ -30,6 +30,9 @@
 #define USB8797_PID_2           0x2044
 #define USB8897_PID_1           0x2045
 #define USB8897_PID_2           0x2046
+#define USB8801_PID_1           0x2049
+#define USB8801_PID_2           0x204a
+
 
 #define USB8XXX_FW_DNLD         1
 #define USB8XXX_FW_READY        2
@@ -41,6 +44,7 @@
 
 #define USB8766_DEFAULT_FW_NAME "mrvl/usb8766_uapsta.bin"
 #define USB8797_DEFAULT_FW_NAME "mrvl/usb8797_uapsta.bin"
+#define USB8801_DEFAULT_FW_NAME "mrvl/usb8801_uapsta.bin"
 #define USB8897_DEFAULT_FW_NAME "mrvl/usb8897_uapsta.bin"
 
 #define FW_DNLD_TX_BUF_SIZE     620
@@ -96,11 +100,4 @@ struct fw_data {
         u8 data[1];
 };
 
-/* This function is called after the card has woken up. */
-static inline int
-mwifiex_pm_wakeup_card_complete(struct mwifiex_adapter *adapter)
-{
-        return 0;
-}
-
 #endif /*_MWIFIEX_USB_H */
diff --git a/drivers/net/wireless/mwifiex/util.c b/drivers/net/wireless/mwifiex/util.c
index b1768fbf98f2..308550611f22 100644
--- a/drivers/net/wireless/mwifiex/util.c
+++ b/drivers/net/wireless/mwifiex/util.c
@@ -25,6 +25,96 @@
 #include "wmm.h"
 #include "11n.h"
 
+static struct mwifiex_debug_data items[] = {
+        {"int_counter", item_size(int_counter),
+         item_addr(int_counter), 1},
+        {"wmm_ac_vo", item_size(packets_out[WMM_AC_VO]),
+         item_addr(packets_out[WMM_AC_VO]), 1},
+        {"wmm_ac_vi", item_size(packets_out[WMM_AC_VI]),
+         item_addr(packets_out[WMM_AC_VI]), 1},
+        {"wmm_ac_be", item_size(packets_out[WMM_AC_BE]),
+         item_addr(packets_out[WMM_AC_BE]), 1},
+        {"wmm_ac_bk", item_size(packets_out[WMM_AC_BK]),
+         item_addr(packets_out[WMM_AC_BK]), 1},
+        {"tx_buf_size", item_size(tx_buf_size),
+         item_addr(tx_buf_size), 1},
+        {"curr_tx_buf_size", item_size(curr_tx_buf_size),
+         item_addr(curr_tx_buf_size), 1},
+        {"ps_mode", item_size(ps_mode),
+         item_addr(ps_mode), 1},
+        {"ps_state", item_size(ps_state),
+         item_addr(ps_state), 1},
+        {"is_deep_sleep", item_size(is_deep_sleep),
+         item_addr(is_deep_sleep), 1},
+        {"wakeup_dev_req", item_size(pm_wakeup_card_req),
+         item_addr(pm_wakeup_card_req), 1},
+        {"wakeup_tries", item_size(pm_wakeup_fw_try),
+         item_addr(pm_wakeup_fw_try), 1},
+        {"hs_configured", item_size(is_hs_configured),
+         item_addr(is_hs_configured), 1},
+        {"hs_activated", item_size(hs_activated),
+         item_addr(hs_activated), 1},
+        {"num_tx_timeout", item_size(num_tx_timeout),
+         item_addr(num_tx_timeout), 1},
+        {"is_cmd_timedout", item_size(is_cmd_timedout),
+         item_addr(is_cmd_timedout), 1},
+        {"timeout_cmd_id", item_size(timeout_cmd_id),
+         item_addr(timeout_cmd_id), 1},
+        {"timeout_cmd_act", item_size(timeout_cmd_act),
+         item_addr(timeout_cmd_act), 1},
+        {"last_cmd_id", item_size(last_cmd_id),
+         item_addr(last_cmd_id), DBG_CMD_NUM},
+        {"last_cmd_act", item_size(last_cmd_act),
+         item_addr(last_cmd_act), DBG_CMD_NUM},
+        {"last_cmd_index", item_size(last_cmd_index),
+         item_addr(last_cmd_index), 1},
+        {"last_cmd_resp_id", item_size(last_cmd_resp_id),
+         item_addr(last_cmd_resp_id), DBG_CMD_NUM},
+        {"last_cmd_resp_index", item_size(last_cmd_resp_index),
+         item_addr(last_cmd_resp_index), 1},
+        {"last_event", item_size(last_event),
+         item_addr(last_event), DBG_CMD_NUM},
+        {"last_event_index", item_size(last_event_index),
+         item_addr(last_event_index), 1},
+        {"num_cmd_h2c_fail", item_size(num_cmd_host_to_card_failure),
+         item_addr(num_cmd_host_to_card_failure), 1},
+        {"num_cmd_sleep_cfm_fail",
+         item_size(num_cmd_sleep_cfm_host_to_card_failure),
+         item_addr(num_cmd_sleep_cfm_host_to_card_failure), 1},
+        {"num_tx_h2c_fail", item_size(num_tx_host_to_card_failure),
+         item_addr(num_tx_host_to_card_failure), 1},
+        {"num_evt_deauth", item_size(num_event_deauth),
+         item_addr(num_event_deauth), 1},
+        {"num_evt_disassoc", item_size(num_event_disassoc),
+         item_addr(num_event_disassoc), 1},
+        {"num_evt_link_lost", item_size(num_event_link_lost),
+         item_addr(num_event_link_lost), 1},
+        {"num_cmd_deauth", item_size(num_cmd_deauth),
+         item_addr(num_cmd_deauth), 1},
+        {"num_cmd_assoc_ok", item_size(num_cmd_assoc_success),
+         item_addr(num_cmd_assoc_success), 1},
+        {"num_cmd_assoc_fail", item_size(num_cmd_assoc_failure),
+         item_addr(num_cmd_assoc_failure), 1},
+        {"cmd_sent", item_size(cmd_sent),
+         item_addr(cmd_sent), 1},
+        {"data_sent", item_size(data_sent),
+         item_addr(data_sent), 1},
+        {"cmd_resp_received", item_size(cmd_resp_received),
+         item_addr(cmd_resp_received), 1},
+        {"event_received", item_size(event_received),
+         item_addr(event_received), 1},
+
+        /* variables defined in struct mwifiex_adapter */
+        {"cmd_pending", adapter_item_size(cmd_pending),
+         adapter_item_addr(cmd_pending), 1},
+        {"tx_pending", adapter_item_size(tx_pending),
+         adapter_item_addr(tx_pending), 1},
+        {"rx_pending", adapter_item_size(rx_pending),
+         adapter_item_addr(rx_pending), 1},
+};
+
+static int num_of_items = ARRAY_SIZE(items);
+
 /*
  * Firmware initialization complete callback handler.
  *
@@ -97,6 +187,8 @@ int mwifiex_get_debug_info(struct mwifiex_private *priv,
                                                               info->rx_tbl);
                 info->tx_tbl_num = mwifiex_get_tx_ba_stream_tbl(priv,
                                                                 info->tx_tbl);
+                info->tdls_peer_num = mwifiex_get_tdls_list(priv,
+                                                            info->tdls_list);
                 info->ps_mode = adapter->ps_mode;
                 info->ps_state = adapter->ps_state;
                 info->is_deep_sleep = adapter->is_deep_sleep;
@@ -141,6 +233,93 @@ int mwifiex_get_debug_info(struct mwifiex_private *priv,
         return 0;
 }
 
+int mwifiex_debug_info_to_buffer(struct mwifiex_private *priv, char *buf,
+                                 struct mwifiex_debug_info *info)
+{
+        char *p = buf;
+        struct mwifiex_debug_data *d = &items[0];
+        size_t size, addr;
+        long val;
+        int i, j;
+
+        if (!info)
+                return 0;
+
+        for (i = 0; i < num_of_items; i++) {
+                p += sprintf(p, "%s=", d[i].name);
+
+                size = d[i].size / d[i].num;
+
+                if (i < (num_of_items - 3))
+                        addr = d[i].addr + (size_t)info;
+                else /* The last 3 items are struct mwifiex_adapter variables */
+                        addr = d[i].addr + (size_t)priv->adapter;
+
+                for (j = 0; j < d[i].num; j++) {
+                        switch (size) {
+                        case 1:
+                                val = *((u8 *)addr);
+                                break;
+                        case 2:
+                                val = *((u16 *)addr);
+                                break;
+                        case 4:
+                                val = *((u32 *)addr);
+                                break;
+                        case 8:
+                                val = *((long long *)addr);
+                                break;
+                        default:
+                                val = -1;
+                                break;
+                        }
+
+                        p += sprintf(p, "%#lx ", val);
+                        addr += size;
+                }
+
+                p += sprintf(p, "\n");
+        }
+
+        if (info->tx_tbl_num) {
+                p += sprintf(p, "Tx BA stream table:\n");
+                for (i = 0; i < info->tx_tbl_num; i++)
+                        p += sprintf(p, "tid = %d, ra = %pM\n",
+                                     info->tx_tbl[i].tid, info->tx_tbl[i].ra);
+        }
+
+        if (info->rx_tbl_num) {
+                p += sprintf(p, "Rx reorder table:\n");
+                for (i = 0; i < info->rx_tbl_num; i++) {
+                        p += sprintf(p, "tid = %d, ta = %pM, ",
+                                     info->rx_tbl[i].tid,
+                                     info->rx_tbl[i].ta);
+                        p += sprintf(p, "start_win = %d, ",
+                                     info->rx_tbl[i].start_win);
+                        p += sprintf(p, "win_size = %d, buffer: ",
+                                     info->rx_tbl[i].win_size);
+
+                        for (j = 0; j < info->rx_tbl[i].win_size; j++)
+                                p += sprintf(p, "%c ",
+                                             info->rx_tbl[i].buffer[j] ?
+                                             '1' : '0');
+
+                        p += sprintf(p, "\n");
+                }
+        }
+
+        if (info->tdls_peer_num) {
+                p += sprintf(p, "TDLS peer table:\n");
+                for (i = 0; i < info->tdls_peer_num; i++) {
+                        p += sprintf(p, "peer = %pM",
+                                     info->tdls_list[i].peer_addr);
+                        p += sprintf(p, "\n");
+                }
+        }
+
+        return p - buf;
+}
+
 static int
 mwifiex_parse_mgmt_packet(struct mwifiex_private *priv, u8 *payload, u16 len,
                           struct rxpd *rx_pd)
@@ -208,7 +387,7 @@ mwifiex_process_mgmt_packet(struct mwifiex_private *priv,
         pkt_len -= ETH_ALEN + sizeof(pkt_len);
         rx_pd->rx_pkt_length = cpu_to_le16(pkt_len);
 
-        cfg80211_rx_mgmt(priv->wdev, priv->roc_cfg.chan.center_freq,
+        cfg80211_rx_mgmt(&priv->wdev, priv->roc_cfg.chan.center_freq,
                          CAL_RSSI(rx_pd->snr, rx_pd->nf), skb->data, pkt_len,
                          0);
 
@@ -404,3 +583,44 @@ void mwifiex_del_all_sta_list(struct mwifiex_private *priv)
         spin_unlock_irqrestore(&priv->sta_list_spinlock, flags);
         return;
 }
+
+/* This function adds histogram data to histogram array*/
+void mwifiex_hist_data_add(struct mwifiex_private *priv,
+                           u8 rx_rate, s8 snr, s8 nflr)
+{
+        struct mwifiex_histogram_data *phist_data = priv->hist_data;
+
+        if (atomic_read(&phist_data->num_samples) > MWIFIEX_HIST_MAX_SAMPLES)
+                mwifiex_hist_data_reset(priv);
+        mwifiex_hist_data_set(priv, rx_rate, snr, nflr);
+}
+
+/* function to add histogram record */
+void mwifiex_hist_data_set(struct mwifiex_private *priv, u8 rx_rate, s8 snr,
+                           s8 nflr)
+{
+        struct mwifiex_histogram_data *phist_data = priv->hist_data;
+
+        atomic_inc(&phist_data->num_samples);
+        atomic_inc(&phist_data->rx_rate[rx_rate]);
+        atomic_inc(&phist_data->snr[snr]);
+        atomic_inc(&phist_data->noise_flr[128 + nflr]);
+        atomic_inc(&phist_data->sig_str[nflr - snr]);
+}
+
+/* function to reset histogram data during init/reset */
+void mwifiex_hist_data_reset(struct mwifiex_private *priv)
+{
+        int ix;
+        struct mwifiex_histogram_data *phist_data = priv->hist_data;
+
+        atomic_set(&phist_data->num_samples, 0);
+        for (ix = 0; ix < MWIFIEX_MAX_AC_RX_RATES; ix++)
+                atomic_set(&phist_data->rx_rate[ix], 0);
+        for (ix = 0; ix < MWIFIEX_MAX_SNR; ix++)
+                atomic_set(&phist_data->snr[ix], 0);
+        for (ix = 0; ix < MWIFIEX_MAX_NOISE_FLR; ix++)
+                atomic_set(&phist_data->noise_flr[ix], 0);
+        for (ix = 0; ix < MWIFIEX_MAX_SIG_STRENGTH; ix++)
+                atomic_set(&phist_data->sig_str[ix], 0);
+}
diff --git a/drivers/net/wireless/mwifiex/util.h b/drivers/net/wireless/mwifiex/util.h
index 40296cb4a3f1..b541d66c01eb 100644
--- a/drivers/net/wireless/mwifiex/util.h
+++ b/drivers/net/wireless/mwifiex/util.h
@@ -20,6 +20,8 @@
 #ifndef _MWIFIEX_UTIL_H_
 #define _MWIFIEX_UTIL_H_
 
+struct mwifiex_private;
+
 struct mwifiex_dma_mapping {
         dma_addr_t addr;
         size_t len;
@@ -33,6 +35,21 @@ struct mwifiex_cb {
         };
 };
 
+/* size/addr for mwifiex_debug_info */
+#define item_size(n)            (FIELD_SIZEOF(struct mwifiex_debug_info, n))
+#define item_addr(n)            (offsetof(struct mwifiex_debug_info, n))
+
+/* size/addr for struct mwifiex_adapter */
+#define adapter_item_size(n)    (FIELD_SIZEOF(struct mwifiex_adapter, n))
+#define adapter_item_addr(n)    (offsetof(struct mwifiex_adapter, n))
+
+struct mwifiex_debug_data {
+        char name[32];          /* variable/array name */
+        u32 size;               /* size of the variable/array */
+        size_t addr;            /* address of the variable/array */
+        int num;                /* number of variables in an array */
+};
+
 static inline struct mwifiex_rxinfo *MWIFIEX_SKB_RXCB(struct sk_buff *skb)
 {
         struct mwifiex_cb *cb = (struct mwifiex_cb *)skb->cb;
@@ -73,4 +90,7 @@ static inline dma_addr_t MWIFIEX_SKB_DMA_ADDR(struct sk_buff *skb)
         return mapping.addr;
 }
 
+int mwifiex_debug_info_to_buffer(struct mwifiex_private *priv, char *buf,
+                                 struct mwifiex_debug_info *info);
+
 #endif /* !_MWIFIEX_UTIL_H_ */
diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c
index ffffd2c5a76e..ef717acec8b7 100644
--- a/drivers/net/wireless/mwifiex/wmm.c
+++ b/drivers/net/wireless/mwifiex/wmm.c
@@ -1228,6 +1228,9 @@ mwifiex_send_processed_packet(struct mwifiex_private *priv,
         case -EINPROGRESS:
                 if (adapter->iface_type != MWIFIEX_PCIE)
                         adapter->data_sent = false;
+                break;
+        case 0:
+                mwifiex_write_data_complete(adapter, skb, 0, ret);
         default:
                 break;
         }
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index b8d1e04aa9b9..f9b1218c761a 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -3098,14 +3098,14 @@ static void mwl8k_update_survey(struct mwl8k_priv *priv,
 
         cca_cnt = ioread32(priv->regs + NOK_CCA_CNT_REG);
         cca_cnt /= 1000; /* uSecs to mSecs */
-        survey->channel_time_busy = (u64) cca_cnt;
+        survey->time_busy = (u64) cca_cnt;
 
         rx_rdy = ioread32(priv->regs + BBU_RXRDY_CNT_REG);
         rx_rdy /= 1000; /* uSecs to mSecs */
-        survey->channel_time_rx = (u64) rx_rdy;
+        survey->time_rx = (u64) rx_rdy;
 
         priv->channel_time = jiffies - priv->channel_time;
-        survey->channel_time = jiffies_to_msecs(priv->channel_time);
+        survey->time = jiffies_to_msecs(priv->channel_time);
 
         survey->channel = channel;
 
@@ -3115,9 +3115,9 @@ static void mwl8k_update_survey(struct mwl8k_priv *priv,
         survey->noise = nf * -1;
 
         survey->filled = SURVEY_INFO_NOISE_DBM |
-                         SURVEY_INFO_CHANNEL_TIME |
-                         SURVEY_INFO_CHANNEL_TIME_BUSY |
-                         SURVEY_INFO_CHANNEL_TIME_RX;
+                         SURVEY_INFO_TIME |
+                         SURVEY_INFO_TIME_BUSY |
+                         SURVEY_INFO_TIME_RX;
 }
 
 /*
diff --git a/drivers/net/wireless/orinoco/Kconfig b/drivers/net/wireless/orinoco/Kconfig
index 60698b020851..6d831d4d1b5f 100644
--- a/drivers/net/wireless/orinoco/Kconfig
+++ b/drivers/net/wireless/orinoco/Kconfig
@@ -1,7 +1,8 @@
 config HERMES
         tristate "Hermes chipset 802.11b support (Orinoco/Prism2/Symbol)"
         depends on (PPC_PMAC || PCI || PCMCIA)
-        depends on CFG80211 && CFG80211_WEXT
+        depends on CFG80211
+        select CFG80211_WEXT
         select WIRELESS_EXT
         select WEXT_SPY
         select WEXT_PRIV
diff --git a/drivers/net/wireless/orinoco/main.c b/drivers/net/wireless/orinoco/main.c
index 38ec8d19ac29..c410180479e6 100644
--- a/drivers/net/wireless/orinoco/main.c
+++ b/drivers/net/wireless/orinoco/main.c
@@ -2342,7 +2342,7 @@ void free_orinocodev(struct orinoco_private *priv)
         list_for_each_entry_safe(sd, sdtemp, &priv->scan_list, list) {
                 list_del(&sd->list);
 
-                if ((sd->len > 0) && sd->buf)
+                if (sd->len > 0)
                         kfree(sd->buf);
                 kfree(sd);
         }
diff --git a/drivers/net/wireless/orinoco/orinoco_pci.c b/drivers/net/wireless/orinoco/orinoco_pci.c
index b6bdad632842..74219d59d7e1 100644
--- a/drivers/net/wireless/orinoco/orinoco_pci.c
+++ b/drivers/net/wireless/orinoco/orinoco_pci.c
@@ -94,7 +94,7 @@ static int orinoco_pci_cor_reset(struct orinoco_private *priv)
         mdelay(HERMES_PCI_COR_OFFT);
 
         /* The card is ready when it's no longer busy */
-        timeout = jiffies + (HERMES_PCI_COR_BUSYT * HZ / 1000);
+        timeout = jiffies + msecs_to_jiffies(HERMES_PCI_COR_BUSYT);
         reg = hermes_read_regn(hw, CMD);
         while (time_before(jiffies, timeout) && (reg & HERMES_CMD_BUSY)) {
                 mdelay(1);
diff --git a/drivers/net/wireless/orinoco/orinoco_plx.c b/drivers/net/wireless/orinoco/orinoco_plx.c
index b8f6e5c431ae..8b045236b6e0 100644
--- a/drivers/net/wireless/orinoco/orinoco_plx.c
+++ b/drivers/net/wireless/orinoco/orinoco_plx.c
@@ -121,7 +121,7 @@ static int orinoco_plx_cor_reset(struct orinoco_private *priv)
         mdelay(1);
 
         /* Just in case, wait more until the card is no longer busy */
-        timeout = jiffies + (PLX_RESET_TIME * HZ / 1000);
+        timeout = jiffies + msecs_to_jiffies(PLX_RESET_TIME);
         reg = hermes_read_regn(hw, CMD);
         while (time_before(jiffies, timeout) && (reg & HERMES_CMD_BUSY)) {
                 mdelay(1);
diff --git a/drivers/net/wireless/orinoco/orinoco_tmd.c b/drivers/net/wireless/orinoco/orinoco_tmd.c
index 79d0e33b625e..20ce569b8a43 100644
--- a/drivers/net/wireless/orinoco/orinoco_tmd.c
+++ b/drivers/net/wireless/orinoco/orinoco_tmd.c
@@ -71,7 +71,7 @@ static int orinoco_tmd_cor_reset(struct orinoco_private *priv)
         mdelay(1);
 
         /* Just in case, wait more until the card is no longer busy */
-        timeout = jiffies + (TMD_RESET_TIME * HZ / 1000);
+        timeout = jiffies + msecs_to_jiffies(TMD_RESET_TIME);
         reg = hermes_read_regn(hw, CMD);
         while (time_before(jiffies, timeout) && (reg & HERMES_CMD_BUSY)) {
                 mdelay(1);
diff --git a/drivers/net/wireless/orinoco/orinoco_usb.c b/drivers/net/wireless/orinoco/orinoco_usb.c
index 995846422dc0..91f05442de28 100644
--- a/drivers/net/wireless/orinoco/orinoco_usb.c
+++ b/drivers/net/wireless/orinoco/orinoco_usb.c
@@ -364,9 +364,7 @@ static struct request_context *ezusb_alloc_ctx(struct ezusb_priv *upriv,
         atomic_set(&ctx->refcount, 1);
         init_completion(&ctx->done);
 
-        init_timer(&ctx->timer);
-        ctx->timer.function = ezusb_request_timerfn;
-        ctx->timer.data = (u_long) ctx;
+        setup_timer(&ctx->timer, ezusb_request_timerfn, (u_long)ctx);
         return ctx;
 }
 
diff --git a/drivers/net/wireless/p54/eeprom.c b/drivers/net/wireless/p54/eeprom.c
index 0fe67d2da208..2fe713eda7ad 100644
--- a/drivers/net/wireless/p54/eeprom.c
+++ b/drivers/net/wireless/p54/eeprom.c
@@ -196,9 +196,9 @@ static int p54_generate_band(struct ieee80211_hw *dev,
                 dest->max_power = chan->max_power;
                 priv->survey[*chan_num].channel = &tmp->channels[j];
                 priv->survey[*chan_num].filled = SURVEY_INFO_NOISE_DBM |
-                        SURVEY_INFO_CHANNEL_TIME |
-                        SURVEY_INFO_CHANNEL_TIME_BUSY |
-                        SURVEY_INFO_CHANNEL_TIME_TX;
+                        SURVEY_INFO_TIME |
+                        SURVEY_INFO_TIME_BUSY |
+                        SURVEY_INFO_TIME_TX;
                 dest->hw_value = (*chan_num);
                 j++;
                 (*chan_num)++;
diff --git a/drivers/net/wireless/p54/fwio.c b/drivers/net/wireless/p54/fwio.c
index bc065e8e348b..5367d510b22d 100644
--- a/drivers/net/wireless/p54/fwio.c
+++ b/drivers/net/wireless/p54/fwio.c
@@ -220,6 +220,7 @@ int p54_download_eeprom(struct p54_common *priv, void *buf,
         struct sk_buff *skb;
         size_t eeprom_hdr_size;
         int ret = 0;
+        long timeout;
 
         if (priv->fw_var >= 0x509)
                 eeprom_hdr_size = sizeof(*eeprom_hdr);
@@ -249,9 +250,11 @@ int p54_download_eeprom(struct p54_common *priv, void *buf,
 
         p54_tx(priv, skb);
 
-        if (!wait_for_completion_interruptible_timeout(
-             &priv->eeprom_comp, HZ)) {
-                wiphy_err(priv->hw->wiphy, "device does not respond!\n");
+        timeout = wait_for_completion_interruptible_timeout(
+                        &priv->eeprom_comp, HZ);
+        if (timeout <= 0) {
+                wiphy_err(priv->hw->wiphy,
+                        "device does not respond or signal received!\n");
                 ret = -EBUSY;
         }
         priv->eeprom = NULL;
diff --git a/drivers/net/wireless/p54/main.c b/drivers/net/wireless/p54/main.c
index 97aeff0edb84..b9250d75d253 100644
--- a/drivers/net/wireless/p54/main.c
+++ b/drivers/net/wireless/p54/main.c
@@ -305,9 +305,9 @@ static void p54_reset_stats(struct p54_common *priv)
                 struct survey_info *info = &priv->survey[chan->hw_value];
 
                 /* only reset channel statistics, don't touch .filled, etc. */
-                info->channel_time = 0;
-                info->channel_time_busy = 0;
-                info->channel_time_tx = 0;
+                info->time = 0;
+                info->time_busy = 0;
+                info->time_tx = 0;
         }
 
         priv->update_stats = true;
@@ -575,6 +575,8 @@ static int p54_set_key(struct ieee80211_hw *dev, enum set_key_cmd cmd,
                         key->hw_key_idx = 0xff;
                         goto out_unlock;
                 }
+
+                key->flags |= IEEE80211_KEY_FLAG_RESERVE_TAILROOM;
         } else {
                 slot = key->hw_key_idx;
 
@@ -634,7 +636,7 @@ static int p54_get_survey(struct ieee80211_hw *dev, int idx,
 
                 if (in_use) {
                         /* test if the reported statistics are valid. */
-                        if  (survey->channel_time != 0) {
+                        if  (survey->time != 0) {
                                 survey->filled |= SURVEY_INFO_IN_USE;
                         } else {
                                 /*
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index d4aee64fb5ea..27a49068d32d 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -431,6 +431,7 @@ static int p54p_open(struct ieee80211_hw *dev)
 {
         struct p54p_priv *priv = dev->priv;
         int err;
+        long timeout;
 
         init_completion(&priv->boot_comp);
         err = request_irq(priv->pdev->irq, p54p_interrupt,
@@ -468,10 +469,12 @@ static int p54p_open(struct ieee80211_hw *dev)
         P54P_WRITE(dev_int, cpu_to_le32(ISL38XX_DEV_INT_RESET));
         P54P_READ(dev_int);
 
-        if (!wait_for_completion_interruptible_timeout(&priv->boot_comp, HZ)) {
+        timeout = wait_for_completion_interruptible_timeout(
+                        &priv->boot_comp, HZ);
+        if (timeout <= 0) {
                 wiphy_err(dev->wiphy, "Cannot boot firmware!\n");
                 p54p_stop(dev);
-                return -ETIMEDOUT;
+                return timeout ? -ERESTARTSYS : -ETIMEDOUT;
         }
 
         P54P_WRITE(int_enable, cpu_to_le32(ISL38XX_INT_IDENT_UPDATE));
diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
index 153c61539ec8..24e5ff9a9272 100644
--- a/drivers/net/wireless/p54/txrx.c
+++ b/drivers/net/wireless/p54/txrx.c
@@ -587,13 +587,13 @@ static void p54_rx_stats(struct p54_common *priv, struct sk_buff *skb)
         if (chan) {
                 struct survey_info *survey = &priv->survey[chan->hw_value];
                 survey->noise = clamp(priv->noise, -128, 127);
-                survey->channel_time = priv->survey_raw.active;
-                survey->channel_time_tx = priv->survey_raw.tx;
-                survey->channel_time_busy = priv->survey_raw.tx +
+                survey->time = priv->survey_raw.active;
+                survey->time_tx = priv->survey_raw.tx;
+                survey->time_busy = priv->survey_raw.tx +
                         priv->survey_raw.cca;
-                do_div(survey->channel_time, 1024);
-                do_div(survey->channel_time_tx, 1024);
-                do_div(survey->channel_time_busy, 1024);
+                do_div(survey->time, 1024);
+                do_div(survey->time_tx, 1024);
+                do_div(survey->time_busy, 1024);
         }
 
         tmp = p54_find_and_unlink_skb(priv, hdr->req_id);
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 1a4facd1fbf3..60d44ce9c017 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -2478,7 +2478,7 @@ static void rndis_fill_station_info(struct usbnet *usbdev,
         ret = rndis_query_oid(usbdev, RNDIS_OID_GEN_LINK_SPEED, &linkspeed, &len);
         if (ret == 0) {
                 sinfo->txrate.legacy = le32_to_cpu(linkspeed) / 1000;
-                sinfo->filled |= STATION_INFO_TX_BITRATE;
+                sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
         }
 
         len = sizeof(rssi);
@@ -2486,7 +2486,7 @@ static void rndis_fill_station_info(struct usbnet *usbdev,
                               &rssi, &len);
         if (ret == 0) {
                 sinfo->signal = level_to_qual(le32_to_cpu(rssi));
-                sinfo->filled |= STATION_INFO_SIGNAL;
+                sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
         }
 }
 
diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
index 4834a9abc171..b6cc9ff47fc2 100644
--- a/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
+++ b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
@@ -172,7 +172,6 @@ static int rsi_load_ta_instructions(struct rsi_common *common)
                 (struct rsi_91x_sdiodev *)adapter->rsi_dev;
         u32 len;
         u32 num_blocks;
-        const u8 *fw;
         const struct firmware *fw_entry = NULL;
         u32 block_size = dev->tx_blk_size;
         int status = 0;
@@ -201,7 +200,6 @@ static int rsi_load_ta_instructions(struct rsi_common *common)
                 return status;
         }
 
-        fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL);
         len = fw_entry->size;
 
         if (len % 4)
@@ -212,7 +210,7 @@ static int rsi_load_ta_instructions(struct rsi_common *common)
         rsi_dbg(INIT_ZONE, "%s: Instruction size:%d\n", __func__, len);
         rsi_dbg(INIT_ZONE, "%s: num blocks: %d\n", __func__, num_blocks);
 
-        status = rsi_copy_to_card(common, fw, len, num_blocks);
+        status = rsi_copy_to_card(common, fw_entry->data, len, num_blocks);
         release_firmware(fw_entry);
         return status;
 }
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 81ee481487cf..be2d54f257b1 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -8020,13 +8020,13 @@ int rt2800_get_survey(struct ieee80211_hw *hw, int idx,
         rt2800_register_read(rt2x00dev, CH_BUSY_STA_SEC, &busy_ext);
 
         if (idle || busy) {
-                survey->filled = SURVEY_INFO_CHANNEL_TIME |
-                                 SURVEY_INFO_CHANNEL_TIME_BUSY |
-                                 SURVEY_INFO_CHANNEL_TIME_EXT_BUSY;
+                survey->filled = SURVEY_INFO_TIME |
+                                 SURVEY_INFO_TIME_BUSY |
+                                 SURVEY_INFO_TIME_EXT_BUSY;
 
-                survey->channel_time = (idle + busy) / 1000;
-                survey->channel_time_busy = busy / 1000;
-                survey->channel_time_ext_busy = busy_ext / 1000;
+                survey->time = (idle + busy) / 1000;
+                survey->time_busy = busy / 1000;
+                survey->time_ext_busy = busy_ext / 1000;
         }
 
         if (!(hw->conf.flags & IEEE80211_CONF_OFFCHANNEL))
diff --git a/drivers/net/wireless/rt2x00/rt2x00config.c b/drivers/net/wireless/rt2x00/rt2x00config.c
index 1122dc44c9fd..48a2cad29477 100644
--- a/drivers/net/wireless/rt2x00/rt2x00config.c
+++ b/drivers/net/wireless/rt2x00/rt2x00config.c
@@ -240,7 +240,7 @@ void rt2x00lib_config(struct rt2x00_dev *rt2x00dev,
                 rt2x00dev->rf_channel = libconf.rf.channel;
         }
 
-        if (test_bit(REQUIRE_PS_AUTOWAKE, &rt2x00dev->cap_flags) &&
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_PS_AUTOWAKE) &&
             (ieee80211_flags & IEEE80211_CONF_CHANGE_PS))
                 cancel_delayed_work_sync(&rt2x00dev->autowakeup_work);
 
@@ -257,7 +257,7 @@ void rt2x00lib_config(struct rt2x00_dev *rt2x00dev,
                 rt2x00link_reset_tuner(rt2x00dev, false);
 
         if (test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags) &&
-            test_bit(REQUIRE_PS_AUTOWAKE, &rt2x00dev->cap_flags) &&
+            rt2x00_has_cap_flag(rt2x00dev, REQUIRE_PS_AUTOWAKE) &&
             (ieee80211_flags & IEEE80211_CONF_CHANGE_PS) &&
             (conf->flags & IEEE80211_CONF_PS)) {
                 beacon_diff = (long)jiffies - (long)rt2x00dev->last_beacon;
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 9967a1d9f0ec..5639ed816813 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -351,7 +351,7 @@ void rt2x00lib_txdone(struct queue_entry *entry,
         /*
          * Remove L2 padding which was added during
          */
-        if (test_bit(REQUIRE_L2PAD, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_L2PAD))
                 rt2x00queue_remove_l2pad(entry->skb, header_length);
 
         /*
@@ -460,7 +460,7 @@ void rt2x00lib_txdone(struct queue_entry *entry,
          * send the status report back.
          */
         if (!(skbdesc_flags & SKBDESC_NOT_MAC80211)) {
-                if (test_bit(REQUIRE_TASKLET_CONTEXT, &rt2x00dev->cap_flags))
+                if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_TASKLET_CONTEXT))
                         ieee80211_tx_status(rt2x00dev->hw, entry->skb);
                 else
                         ieee80211_tx_status_ni(rt2x00dev->hw, entry->skb);
@@ -1056,9 +1056,9 @@ static int rt2x00lib_probe_hw(struct rt2x00_dev *rt2x00dev)
         /*
          * Take TX headroom required for alignment into account.
          */
-        if (test_bit(REQUIRE_L2PAD, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_L2PAD))
                 rt2x00dev->hw->extra_tx_headroom += RT2X00_L2PAD_SIZE;
-        else if (test_bit(REQUIRE_DMA, &rt2x00dev->cap_flags))
+        else if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DMA))
                 rt2x00dev->hw->extra_tx_headroom += RT2X00_ALIGN_SIZE;
 
         /*
@@ -1069,7 +1069,7 @@ static int rt2x00lib_probe_hw(struct rt2x00_dev *rt2x00dev)
         /*
          * Allocate tx status FIFO for driver use.
          */
-        if (test_bit(REQUIRE_TXSTATUS_FIFO, &rt2x00dev->cap_flags)) {
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_TXSTATUS_FIFO)) {
                 /*
                  * Allocate the txstatus fifo. In the worst case the tx
                  * status fifo has to hold the tx status of all entries
@@ -1131,7 +1131,7 @@ static void rt2x00lib_uninitialize(struct rt2x00_dev *rt2x00dev)
         /*
          * Stop rfkill polling.
          */
-        if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DELAYED_RFKILL))
                 rt2x00rfkill_unregister(rt2x00dev);
 
         /*
@@ -1173,7 +1173,7 @@ static int rt2x00lib_initialize(struct rt2x00_dev *rt2x00dev)
         /*
          * Start rfkill polling.
          */
-        if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DELAYED_RFKILL))
                 rt2x00rfkill_register(rt2x00dev);
 
         return 0;
@@ -1389,7 +1389,7 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
         /*
          * Start rfkill polling.
          */
-        if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+        if (!rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DELAYED_RFKILL))
                 rt2x00rfkill_register(rt2x00dev);
 
         return 0;
@@ -1408,7 +1408,7 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
         /*
          * Stop rfkill polling.
          */
-        if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+        if (!rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DELAYED_RFKILL))
                 rt2x00rfkill_unregister(rt2x00dev);
 
         /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00firmware.c b/drivers/net/wireless/rt2x00/rt2x00firmware.c
index fbae2799e3ee..5813300f68a2 100644
--- a/drivers/net/wireless/rt2x00/rt2x00firmware.c
+++ b/drivers/net/wireless/rt2x00/rt2x00firmware.c
@@ -96,7 +96,7 @@ int rt2x00lib_load_firmware(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
 
-        if (!test_bit(REQUIRE_FIRMWARE, &rt2x00dev->cap_flags))
+        if (!rt2x00_has_cap_flag(rt2x00dev, REQUIRE_FIRMWARE))
                 return 0;
 
         if (!rt2x00dev->fw) {
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index cb40245a0695..300876df056f 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -119,7 +119,7 @@ void rt2x00mac_tx(struct ieee80211_hw *hw,
          * Use the ATIM queue if appropriate and present.
          */
         if (tx_info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM &&
-            test_bit(REQUIRE_ATIM_QUEUE, &rt2x00dev->cap_flags))
+            rt2x00_has_cap_flag(rt2x00dev, REQUIRE_ATIM_QUEUE))
                 qid = QID_ATIM;
 
         queue = rt2x00queue_get_tx_queue(rt2x00dev, qid);
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 66ff36447b94..68b620b2462f 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -85,7 +85,7 @@ struct sk_buff *rt2x00queue_alloc_rxskb(struct queue_entry *entry, gfp_t gfp)
         memset(skbdesc, 0, sizeof(*skbdesc));
         skbdesc->entry = entry;
 
-        if (test_bit(REQUIRE_DMA, &rt2x00dev->cap_flags)) {
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DMA)) {
                 dma_addr_t skb_dma;
 
                 skb_dma = dma_map_single(rt2x00dev->dev, skb->data, skb->len,
@@ -198,7 +198,7 @@ static void rt2x00queue_create_tx_descriptor_seq(struct rt2x00_dev *rt2x00dev,
 
         __set_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags);
 
-        if (!test_bit(REQUIRE_SW_SEQNO, &rt2x00dev->cap_flags)) {
+        if (!rt2x00_has_cap_flag(rt2x00dev, REQUIRE_SW_SEQNO)) {
                 /*
                  * rt2800 has a H/W (or F/W) bug, device incorrectly increase
                  * seqno on retransmited data (non-QOS) frames. To workaround
@@ -484,7 +484,7 @@ static void rt2x00queue_create_tx_descriptor(struct rt2x00_dev *rt2x00dev,
         rt2x00crypto_create_tx_descriptor(rt2x00dev, skb, txdesc);
         rt2x00queue_create_tx_descriptor_seq(rt2x00dev, skb, txdesc);
 
-        if (test_bit(REQUIRE_HT_TX_DESC, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_HT_TX_DESC))
                 rt2x00queue_create_tx_descriptor_ht(rt2x00dev, skb, txdesc,
                                                    sta, hwrate);
         else
@@ -526,7 +526,7 @@ static int rt2x00queue_write_tx_data(struct queue_entry *entry,
         /*
          * Map the skb to DMA.
          */
-        if (test_bit(REQUIRE_DMA, &rt2x00dev->cap_flags) &&
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DMA) &&
             rt2x00queue_map_txskb(entry))
                 return -ENOMEM;
 
@@ -646,7 +646,7 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
          */
         if (test_bit(ENTRY_TXD_ENCRYPT, &txdesc.flags) &&
             !test_bit(ENTRY_TXD_ENCRYPT_IV, &txdesc.flags)) {
-                if (test_bit(REQUIRE_COPY_IV, &queue->rt2x00dev->cap_flags))
+                if (rt2x00_has_cap_flag(queue->rt2x00dev, REQUIRE_COPY_IV))
                         rt2x00crypto_tx_copy_iv(skb, &txdesc);
                 else
                         rt2x00crypto_tx_remove_iv(skb, &txdesc);
@@ -660,9 +660,9 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
          * PCI and USB devices, while header alignment only is valid
          * for PCI devices.
          */
-        if (test_bit(REQUIRE_L2PAD, &queue->rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_flag(queue->rt2x00dev, REQUIRE_L2PAD))
                 rt2x00queue_insert_l2pad(skb, txdesc.header_length);
-        else if (test_bit(REQUIRE_DMA, &queue->rt2x00dev->cap_flags))
+        else if (rt2x00_has_cap_flag(queue->rt2x00dev, REQUIRE_DMA))
                 rt2x00queue_align_frame(skb);
 
         /*
@@ -1178,7 +1178,7 @@ int rt2x00queue_initialize(struct rt2x00_dev *rt2x00dev)
         if (status)
                 goto exit;
 
-        if (test_bit(REQUIRE_ATIM_QUEUE, &rt2x00dev->cap_flags)) {
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_ATIM_QUEUE)) {
                 status = rt2x00queue_alloc_entries(rt2x00dev->atim);
                 if (status)
                         goto exit;
@@ -1234,7 +1234,7 @@ int rt2x00queue_allocate(struct rt2x00_dev *rt2x00dev)
         struct data_queue *queue;
         enum data_queue_qid qid;
         unsigned int req_atim =
-            !!test_bit(REQUIRE_ATIM_QUEUE, &rt2x00dev->cap_flags);
+            rt2x00_has_cap_flag(rt2x00dev, REQUIRE_ATIM_QUEUE);
 
         /*
          * We need the following queues:
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index 892270dd3e7b..7627af6098eb 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -274,7 +274,7 @@ static void rt2x00usb_interrupt_txdone(struct urb *urb)
          * Schedule the delayed work for reading the TX status
          * from the device.
          */
-        if (!test_bit(REQUIRE_TXSTATUS_FIFO, &rt2x00dev->cap_flags) ||
+        if (!rt2x00_has_cap_flag(rt2x00dev, REQUIRE_TXSTATUS_FIFO) ||
             !kfifo_is_empty(&rt2x00dev->txstatus_fifo))
                 queue_work(rt2x00dev->workqueue, &rt2x00dev->txdone_work);
 }
@@ -456,7 +456,7 @@ static bool rt2x00usb_flush_entry(struct queue_entry *entry, void *data)
          * Kill guardian urb (if required by driver).
          */
         if ((entry->queue->qid == QID_BEACON) &&
-            (test_bit(REQUIRE_BEACON_GUARD, &rt2x00dev->cap_flags)))
+            (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_BEACON_GUARD)))
                 usb_kill_urb(bcn_priv->guardian_urb);
 
         return false;
@@ -655,7 +655,7 @@ static int rt2x00usb_alloc_entries(struct data_queue *queue)
          * then we are done.
          */
         if (queue->qid != QID_BEACON ||
-            !test_bit(REQUIRE_BEACON_GUARD, &rt2x00dev->cap_flags))
+            !rt2x00_has_cap_flag(rt2x00dev, REQUIRE_BEACON_GUARD))
                 return 0;
 
         for (i = 0; i < queue->limit; i++) {
@@ -690,7 +690,7 @@ static void rt2x00usb_free_entries(struct data_queue *queue)
          * then we are done.
          */
         if (queue->qid != QID_BEACON ||
-            !test_bit(REQUIRE_BEACON_GUARD, &rt2x00dev->cap_flags))
+            !rt2x00_has_cap_flag(rt2x00dev, REQUIRE_BEACON_GUARD))
                 return;
 
         for (i = 0; i < queue->limit; i++) {
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 40b6d1d006d7..1d4677460711 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -867,63 +867,135 @@ static u8 _rtl_get_highest_n_rate(struct ieee80211_hw *hw,
  *
  * B/G rate:
  * (rx_status->flag & RX_FLAG_HT) = 0,
- * DESC92_RATE1M-->DESC92_RATE54M ==> idx is 0-->11,
+ * DESC_RATE1M-->DESC_RATE54M ==> idx is 0-->11,
  *
  * N rate:
  * (rx_status->flag & RX_FLAG_HT) = 1,
- * DESC92_RATEMCS0-->DESC92_RATEMCS15 ==> idx is 0-->15
+ * DESC_RATEMCS0-->DESC_RATEMCS15 ==> idx is 0-->15
  *
  * 5G band:rx_status->band == IEEE80211_BAND_5GHZ
  * A rate:
  * (rx_status->flag & RX_FLAG_HT) = 0,
- * DESC92_RATE6M-->DESC92_RATE54M ==> idx is 0-->7,
+ * DESC_RATE6M-->DESC_RATE54M ==> idx is 0-->7,
  *
  * N rate:
  * (rx_status->flag & RX_FLAG_HT) = 1,
- * DESC92_RATEMCS0-->DESC92_RATEMCS15 ==> idx is 0-->15
+ * DESC_RATEMCS0-->DESC_RATEMCS15 ==> idx is 0-->15
+ *
+ * VHT rates:
+ * DESC_RATEVHT1SS_MCS0-->DESC_RATEVHT1SS_MCS9 ==> idx is 0-->9
+ * DESC_RATEVHT2SS_MCS0-->DESC_RATEVHT2SS_MCS9 ==> idx is 0-->9
  */
-int rtlwifi_rate_mapping(struct ieee80211_hw *hw,
-                         bool isht, u8 desc_rate, bool first_ampdu)
+int rtlwifi_rate_mapping(struct ieee80211_hw *hw, bool isht, bool isvht,
+                         u8 desc_rate)
 {
         int rate_idx;
 
+        if (isvht) {
+                switch (desc_rate) {
+                case DESC_RATEVHT1SS_MCS0:
+                        rate_idx = 0;
+                        break;
+                case DESC_RATEVHT1SS_MCS1:
+                        rate_idx = 1;
+                        break;
+                case DESC_RATEVHT1SS_MCS2:
+                        rate_idx = 2;
+                        break;
+                case DESC_RATEVHT1SS_MCS3:
+                        rate_idx = 3;
+                        break;
+                case DESC_RATEVHT1SS_MCS4:
+                        rate_idx = 4;
+                        break;
+                case DESC_RATEVHT1SS_MCS5:
+                        rate_idx = 5;
+                        break;
+                case DESC_RATEVHT1SS_MCS6:
+                        rate_idx = 6;
+                        break;
+                case DESC_RATEVHT1SS_MCS7:
+                        rate_idx = 7;
+                        break;
+                case DESC_RATEVHT1SS_MCS8:
+                        rate_idx = 8;
+                        break;
+                case DESC_RATEVHT1SS_MCS9:
+                        rate_idx = 9;
+                        break;
+                case DESC_RATEVHT2SS_MCS0:
+                        rate_idx = 0;
+                        break;
+                case DESC_RATEVHT2SS_MCS1:
+                        rate_idx = 1;
+                        break;
+                case DESC_RATEVHT2SS_MCS2:
+                        rate_idx = 2;
+                        break;
+                case DESC_RATEVHT2SS_MCS3:
+                        rate_idx = 3;
+                        break;
+                case DESC_RATEVHT2SS_MCS4:
+                        rate_idx = 4;
+                        break;
+                case DESC_RATEVHT2SS_MCS5:
+                        rate_idx = 5;
+                        break;
+                case DESC_RATEVHT2SS_MCS6:
+                        rate_idx = 6;
+                        break;
+                case DESC_RATEVHT2SS_MCS7:
+                        rate_idx = 7;
+                        break;
+                case DESC_RATEVHT2SS_MCS8:
+                        rate_idx = 8;
+                        break;
+                case DESC_RATEVHT2SS_MCS9:
+                        rate_idx = 9;
+                        break;
+                default:
+                        rate_idx = 0;
+                        break;
+                }
+                return rate_idx;
+        }
         if (false == isht) {
                 if (IEEE80211_BAND_2GHZ == hw->conf.chandef.chan->band) {
                         switch (desc_rate) {
-                        case DESC92_RATE1M:
+                        case DESC_RATE1M:
                                 rate_idx = 0;
                                 break;
-                        case DESC92_RATE2M:
+                        case DESC_RATE2M:
                                 rate_idx = 1;
                                 break;
-                        case DESC92_RATE5_5M:
+                        case DESC_RATE5_5M:
                                 rate_idx = 2;
                                 break;
-                        case DESC92_RATE11M:
+                        case DESC_RATE11M:
                                 rate_idx = 3;
                                 break;
-                        case DESC92_RATE6M:
+                        case DESC_RATE6M:
                                 rate_idx = 4;
                                 break;
-                        case DESC92_RATE9M:
+                        case DESC_RATE9M:
                                 rate_idx = 5;
                                 break;
-                        case DESC92_RATE12M:
+                        case DESC_RATE12M:
                                 rate_idx = 6;
                                 break;
-                        case DESC92_RATE18M:
+                        case DESC_RATE18M:
                                 rate_idx = 7;
                                 break;
-                        case DESC92_RATE24M:
+                        case DESC_RATE24M:
                                 rate_idx = 8;
                                 break;
-                        case DESC92_RATE36M:
+                        case DESC_RATE36M:
                                 rate_idx = 9;
                                 break;
-                        case DESC92_RATE48M:
+                        case DESC_RATE48M:
                                 rate_idx = 10;
                                 break;
-                        case DESC92_RATE54M:
+                        case DESC_RATE54M:
                                 rate_idx = 11;
                                 break;
                         default:
@@ -932,28 +1004,28 @@ int rtlwifi_rate_mapping(struct ieee80211_hw *hw,
                         }
                 } else {
                         switch (desc_rate) {
-                        case DESC92_RATE6M:
+                        case DESC_RATE6M:
                                 rate_idx = 0;
                                 break;
-                        case DESC92_RATE9M:
+                        case DESC_RATE9M:
                                 rate_idx = 1;
                                 break;
-                        case DESC92_RATE12M:
+                        case DESC_RATE12M:
                                 rate_idx = 2;
                                 break;
-                        case DESC92_RATE18M:
+                        case DESC_RATE18M:
                                 rate_idx = 3;
                                 break;
-                        case DESC92_RATE24M:
+                        case DESC_RATE24M:
                                 rate_idx = 4;
                                 break;
-                        case DESC92_RATE36M:
+                        case DESC_RATE36M:
                                 rate_idx = 5;
                                 break;
-                        case DESC92_RATE48M:
+                        case DESC_RATE48M:
                                 rate_idx = 6;
                                 break;
-                        case DESC92_RATE54M:
+                        case DESC_RATE54M:
                                 rate_idx = 7;
                                 break;
                         default:
@@ -963,52 +1035,52 @@ int rtlwifi_rate_mapping(struct ieee80211_hw *hw,
                 }
         } else {
                 switch (desc_rate) {
-                case DESC92_RATEMCS0:
+                case DESC_RATEMCS0:
                         rate_idx = 0;
                         break;
-                case DESC92_RATEMCS1:
+                case DESC_RATEMCS1:
                         rate_idx = 1;
                         break;
-                case DESC92_RATEMCS2:
+                case DESC_RATEMCS2:
                         rate_idx = 2;
                         break;
-                case DESC92_RATEMCS3:
+                case DESC_RATEMCS3:
                         rate_idx = 3;
                         break;
-                case DESC92_RATEMCS4:
+                case DESC_RATEMCS4:
                         rate_idx = 4;
                         break;
-                case DESC92_RATEMCS5:
+                case DESC_RATEMCS5:
                         rate_idx = 5;
                         break;
-                case DESC92_RATEMCS6:
+                case DESC_RATEMCS6:
                         rate_idx = 6;
                         break;
-                case DESC92_RATEMCS7:
+                case DESC_RATEMCS7:
                         rate_idx = 7;
                         break;
-                case DESC92_RATEMCS8:
+                case DESC_RATEMCS8:
                         rate_idx = 8;
                         break;
-                case DESC92_RATEMCS9:
+                case DESC_RATEMCS9:
                         rate_idx = 9;
                         break;
-                case DESC92_RATEMCS10:
+                case DESC_RATEMCS10:
                         rate_idx = 10;
                         break;
-                case DESC92_RATEMCS11:
+                case DESC_RATEMCS11:
                         rate_idx = 11;
                         break;
-                case DESC92_RATEMCS12:
+                case DESC_RATEMCS12:
                         rate_idx = 12;
                         break;
-                case DESC92_RATEMCS13:
+                case DESC_RATEMCS13:
                         rate_idx = 13;
                         break;
-                case DESC92_RATEMCS14:
+                case DESC_RATEMCS14:
                         rate_idx = 14;
                         break;
-                case DESC92_RATEMCS15:
+                case DESC_RATEMCS15:
                         rate_idx = 15;
                         break;
                 default:
diff --git a/drivers/net/wireless/rtlwifi/base.h b/drivers/net/wireless/rtlwifi/base.h
index 982f2450feea..c6cb49c3ee32 100644
--- a/drivers/net/wireless/rtlwifi/base.h
+++ b/drivers/net/wireless/rtlwifi/base.h
@@ -123,8 +123,8 @@ void rtl_watch_dog_timer_callback(unsigned long data);
 void rtl_deinit_deferred_work(struct ieee80211_hw *hw);
 
 bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx);
-int rtlwifi_rate_mapping(struct ieee80211_hw *hw,
-                         bool isht, u8 desc_rate, bool first_ampdu);
+int rtlwifi_rate_mapping(struct ieee80211_hw *hw, bool isht,
+                         bool isvht, u8 desc_rate);
 bool rtl_tx_mgmt_proc(struct ieee80211_hw *hw, struct sk_buff *skb);
 u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx);
 
diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c
index 5fc6f52641bd..a31a12775f1a 100644
--- a/drivers/net/wireless/rtlwifi/core.c
+++ b/drivers/net/wireless/rtlwifi/core.c
@@ -95,7 +95,8 @@ void rtl_bb_delay(struct ieee80211_hw *hw, u32 addr, u32 data)
 }
 EXPORT_SYMBOL(rtl_bb_delay);
 
-void rtl_fw_cb(const struct firmware *firmware, void *context)
+static void rtl_fw_do_work(const struct firmware *firmware, void *context,
+                           bool is_wow)
 {
         struct ieee80211_hw *hw = context;
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -125,12 +126,31 @@ found_alt:
                 release_firmware(firmware);
                 return;
         }
-        memcpy(rtlpriv->rtlhal.pfirmware, firmware->data, firmware->size);
+        if (!is_wow) {
+                memcpy(rtlpriv->rtlhal.pfirmware, firmware->data,
+                       firmware->size);
+                rtlpriv->rtlhal.fwsize = firmware->size;
+        } else {
+                memcpy(rtlpriv->rtlhal.wowlan_firmware, firmware->data,
+                       firmware->size);
+                rtlpriv->rtlhal.wowlan_fwsize = firmware->size;
+        }
         rtlpriv->rtlhal.fwsize = firmware->size;
         release_firmware(firmware);
 }
+
+void rtl_fw_cb(const struct firmware *firmware, void *context)
+{
+        rtl_fw_do_work(firmware, context, false);
+}
 EXPORT_SYMBOL(rtl_fw_cb);
 
+void rtl_wowlan_fw_cb(const struct firmware *firmware, void *context)
+{
+        rtl_fw_do_work(firmware, context, true);
+}
+EXPORT_SYMBOL(rtl_wowlan_fw_cb);
+
 /*mutex for start & stop is must here. */
 static int rtl_op_start(struct ieee80211_hw *hw)
 {
@@ -990,6 +1010,16 @@ static int rtl_op_conf_tx(struct ieee80211_hw *hw,
         return 0;
 }
 
+static void send_beacon_frame(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct sk_buff *skb = ieee80211_beacon_get(hw, vif);
+
+        if (skb)
+                rtlpriv->intf_ops->adapter_tx(hw, NULL, skb, NULL);
+}
+
 static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
                                     struct ieee80211_vif *vif,
                                     struct ieee80211_bss_conf *bss_conf,
@@ -1020,6 +1050,7 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
 
                                 if (rtlpriv->cfg->ops->linked_set_reg)
                                         rtlpriv->cfg->ops->linked_set_reg(hw);
+                                send_beacon_frame(hw, vif);
                         }
                 }
                 if ((changed & BSS_CHANGED_BEACON_ENABLED &&
@@ -1851,3 +1882,40 @@ bool rtl_btc_status_false(void)
         return false;
 }
 EXPORT_SYMBOL_GPL(rtl_btc_status_false);
+
+void rtl_dm_diginit(struct ieee80211_hw *hw, u32 cur_igvalue)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct dig_t *dm_digtable = &rtlpriv->dm_digtable;
+
+        dm_digtable->dig_enable_flag = true;
+        dm_digtable->dig_ext_port_stage = DIG_EXT_PORT_STAGE_MAX;
+        dm_digtable->cur_igvalue = cur_igvalue;
+        dm_digtable->pre_igvalue = 0;
+        dm_digtable->cur_sta_cstate = DIG_STA_DISCONNECT;
+        dm_digtable->presta_cstate = DIG_STA_DISCONNECT;
+        dm_digtable->curmultista_cstate = DIG_MULTISTA_DISCONNECT;
+        dm_digtable->rssi_lowthresh = DM_DIG_THRESH_LOW;
+        dm_digtable->rssi_highthresh = DM_DIG_THRESH_HIGH;
+        dm_digtable->fa_lowthresh = DM_FALSEALARM_THRESH_LOW;
+        dm_digtable->fa_highthresh = DM_FALSEALARM_THRESH_HIGH;
+        dm_digtable->rx_gain_max = DM_DIG_MAX;
+        dm_digtable->rx_gain_min = DM_DIG_MIN;
+        dm_digtable->back_val = DM_DIG_BACKOFF_DEFAULT;
+        dm_digtable->back_range_max = DM_DIG_BACKOFF_MAX;
+        dm_digtable->back_range_min = DM_DIG_BACKOFF_MIN;
+        dm_digtable->pre_cck_cca_thres = 0xff;
+        dm_digtable->cur_cck_cca_thres = 0x83;
+        dm_digtable->forbidden_igi = DM_DIG_MIN;
+        dm_digtable->large_fa_hit = 0;
+        dm_digtable->recover_cnt = 0;
+        dm_digtable->dig_min_0 = 0x25;
+        dm_digtable->dig_min_1 = 0x25;
+        dm_digtable->media_connect_0 = false;
+        dm_digtable->media_connect_1 = false;
+        rtlpriv->dm.dm_initialgain_enable = true;
+        dm_digtable->bt30_cur_igi = 0x32;
+        dm_digtable->pre_cck_pd_state = CCK_PD_STAGE_MAX;
+        dm_digtable->cur_cck_pd_state = CCK_PD_STAGE_LOWRSSI;
+}
+EXPORT_SYMBOL(rtl_dm_diginit);
diff --git a/drivers/net/wireless/rtlwifi/core.h b/drivers/net/wireless/rtlwifi/core.h
index 624e1dc16d31..7b64e34f421e 100644
--- a/drivers/net/wireless/rtlwifi/core.h
+++ b/drivers/net/wireless/rtlwifi/core.h
@@ -35,13 +35,55 @@
 
 #define RTL_SUPPORTED_CTRL_FILTER       0xFF
 
+#define DM_DIG_THRESH_HIGH              40
+#define DM_DIG_THRESH_LOW               35
+#define DM_FALSEALARM_THRESH_LOW        400
+#define DM_FALSEALARM_THRESH_HIGH       1000
+
+#define DM_DIG_MAX                      0x3e
+#define DM_DIG_MIN                      0x1e
+#define DM_DIG_MAX_AP                   0x32
+#define DM_DIG_BACKOFF_MAX              12
+#define DM_DIG_BACKOFF_MIN              -4
+#define DM_DIG_BACKOFF_DEFAULT          10
+
+enum cck_packet_detection_threshold {
+        CCK_PD_STAGE_LOWRSSI = 0,
+        CCK_PD_STAGE_HIGHRSSI = 1,
+        CCK_FA_STAGE_LOW = 2,
+        CCK_FA_STAGE_HIGH = 3,
+        CCK_PD_STAGE_MAX = 4,
+};
+
+enum dm_dig_ext_port_alg_e {
+        DIG_EXT_PORT_STAGE_0 = 0,
+        DIG_EXT_PORT_STAGE_1 = 1,
+        DIG_EXT_PORT_STAGE_2 = 2,
+        DIG_EXT_PORT_STAGE_3 = 3,
+        DIG_EXT_PORT_STAGE_MAX = 4,
+};
+
+enum dm_dig_connect_e {
+        DIG_STA_DISCONNECT,
+        DIG_STA_CONNECT,
+        DIG_STA_BEFORE_CONNECT,
+        DIG_MULTISTA_DISCONNECT,
+        DIG_MULTISTA_CONNECT,
+        DIG_AP_DISCONNECT,
+        DIG_AP_CONNECT,
+        DIG_AP_ADD_STATION,
+        DIG_CONNECT_MAX
+};
+
 extern const struct ieee80211_ops rtl_ops;
 void rtl_fw_cb(const struct firmware *firmware, void *context);
+void rtl_wowlan_fw_cb(const struct firmware *firmware, void *context);
 void rtl_addr_delay(u32 addr);
 void rtl_rfreg_delay(struct ieee80211_hw *hw, enum radio_path rfpath, u32 addr,
                      u32 mask, u32 data);
 void rtl_bb_delay(struct ieee80211_hw *hw, u32 addr, u32 data);
 bool rtl_cmd_send_packet(struct ieee80211_hw *hw, struct sk_buff *skb);
 bool rtl_btc_status_false(void);
+void rtl_dm_diginit(struct ieee80211_hw *hw, u32 cur_igval);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index c70efb9a6e78..ec456f0d972e 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -578,6 +578,13 @@ static void _rtl_pci_tx_isr(struct ieee80211_hw *hw, int prio)
                 else
                         entry = (u8 *)(&ring->desc[ring->idx]);
 
+                if (rtlpriv->cfg->ops->get_available_desc &&
+                    rtlpriv->cfg->ops->get_available_desc(hw, prio) <= 1) {
+                        RT_TRACE(rtlpriv, (COMP_INTR | COMP_SEND), DBG_DMESG,
+                                 "no available desc!\n");
+                        return;
+                }
+
                 if (!rtlpriv->cfg->ops->is_tx_desc_closed(hw, prio, ring->idx))
                         return;
                 ring->idx = (ring->idx + 1) % ring->entries;
@@ -641,10 +648,9 @@ static void _rtl_pci_tx_isr(struct ieee80211_hw *hw, int prio)
 
                 ieee80211_tx_status_irqsafe(hw, skb);
 
-                if ((ring->entries - skb_queue_len(&ring->queue))
-                                == 2) {
+                if ((ring->entries - skb_queue_len(&ring->queue)) <= 4) {
 
-                        RT_TRACE(rtlpriv, COMP_ERR, DBG_LOUD,
+                        RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
                                  "more desc left, wake skb_queue@%d, ring->idx = %d, skb_queue_len = 0x%x\n",
                                  prio, ring->idx,
                                  skb_queue_len(&ring->queue));
@@ -793,7 +799,7 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                         rx_remained_cnt =
                                 rtlpriv->cfg->ops->rx_desc_buff_remained_cnt(hw,
                                                                       hw_queue);
-                        if (rx_remained_cnt < 1)
+                        if (rx_remained_cnt == 0)
                                 return;
 
                 } else {        /* rx descriptor */
@@ -848,18 +854,18 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                         else
                                 skb_reserve(skb, stats.rx_drvinfo_size +
                                             stats.rx_bufshift);
-
                 } else {
                         RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
                                  "skb->end - skb->tail = %d, len is %d\n",
                                  skb->end - skb->tail, len);
-                        break;
+                        dev_kfree_skb_any(skb);
+                        goto new_trx_end;
                 }
                 /* handle command packet here */
                 if (rtlpriv->cfg->ops->rx_command_packet &&
                     rtlpriv->cfg->ops->rx_command_packet(hw, stats, skb)) {
                                 dev_kfree_skb_any(skb);
-                                goto end;
+                                goto new_trx_end;
                 }
 
                 /*
@@ -909,6 +915,7 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                 } else {
                         dev_kfree_skb_any(skb);
                 }
+new_trx_end:
                 if (rtlpriv->use_new_trx_flow) {
                         rtlpci->rx_ring[hw_queue].next_rx_rp += 1;
                         rtlpci->rx_ring[hw_queue].next_rx_rp %=
@@ -924,7 +931,6 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                         rtlpriv->enter_ps = false;
                         schedule_work(&rtlpriv->works.lps_change_work);
                 }
-end:
                 skb = new_skb;
 no_new:
                 if (rtlpriv->use_new_trx_flow) {
@@ -1688,6 +1694,15 @@ static int rtl_pci_tx(struct ieee80211_hw *hw,
                 }
         }
 
+        if (rtlpriv->cfg->ops->get_available_desc &&
+            rtlpriv->cfg->ops->get_available_desc(hw, hw_queue) == 0) {
+                        RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+                                 "get_available_desc fail\n");
+                        spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock,
+                                               flags);
+                        return skb->len;
+        }
+
         if (ieee80211_is_data_qos(fc)) {
                 tid = rtl_get_tid(skb);
                 if (sta) {
diff --git a/drivers/net/wireless/rtlwifi/pci.h b/drivers/net/wireless/rtlwifi/pci.h
index 5e832306dba9..d4567d12e07e 100644
--- a/drivers/net/wireless/rtlwifi/pci.h
+++ b/drivers/net/wireless/rtlwifi/pci.h
@@ -325,4 +325,11 @@ static inline void pci_write32_async(struct rtl_priv *rtlpriv,
         writel(val, (u8 __iomem *) rtlpriv->io.pci_mem_start + addr);
 }
 
+static inline u16 calc_fifo_space(u16 rp, u16 wp)
+{
+        if (rp <= wp)
+                return RTL_PCI_MAX_RX_COUNT - 1 + rp - wp;
+        return rp - wp - 1;
+}
+
 #endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c b/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c
index 2aa34d9055f0..d930c1f78721 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c
@@ -26,6 +26,7 @@
 #include "../wifi.h"
 #include "../base.h"
 #include "../pci.h"
+#include "../core.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -341,38 +342,6 @@ static void dm_tx_pwr_track_set_pwr(struct ieee80211_hw *hw,
         }
 }
 
-static void rtl88e_dm_diginit(struct ieee80211_hw *hw)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct dig_t *dm_dig = &rtlpriv->dm_digtable;
-
-        dm_dig->dig_enable_flag = true;
-        dm_dig->cur_igvalue = rtl_get_bbreg(hw, ROFDM0_XAAGCCORE1, 0x7f);
-        dm_dig->pre_igvalue = 0;
-        dm_dig->cur_sta_cstate = DIG_STA_DISCONNECT;
-        dm_dig->presta_cstate = DIG_STA_DISCONNECT;
-        dm_dig->curmultista_cstate = DIG_MULTISTA_DISCONNECT;
-        dm_dig->rssi_lowthresh = DM_DIG_THRESH_LOW;
-        dm_dig->rssi_highthresh = DM_DIG_THRESH_HIGH;
-        dm_dig->fa_lowthresh = DM_FALSEALARM_THRESH_LOW;
-        dm_dig->fa_highthresh = DM_FALSEALARM_THRESH_HIGH;
-        dm_dig->rx_gain_max = DM_DIG_MAX;
-        dm_dig->rx_gain_min = DM_DIG_MIN;
-        dm_dig->back_val = DM_DIG_BACKOFF_DEFAULT;
-        dm_dig->back_range_max = DM_DIG_BACKOFF_MAX;
-        dm_dig->back_range_min = DM_DIG_BACKOFF_MIN;
-        dm_dig->pre_cck_cca_thres = 0xff;
-        dm_dig->cur_cck_cca_thres = 0x83;
-        dm_dig->forbidden_igi = DM_DIG_MIN;
-        dm_dig->large_fa_hit = 0;
-        dm_dig->recover_cnt = 0;
-        dm_dig->dig_min_0 = 0x25;
-        dm_dig->dig_min_1 = 0x25;
-        dm_dig->media_connect_0 = false;
-        dm_dig->media_connect_1 = false;
-        rtlpriv->dm.dm_initialgain_enable = true;
-}
-
 static u8 rtl88e_dm_initial_gain_min_pwdb(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -1796,9 +1765,10 @@ static void rtl88e_dm_antenna_diversity(struct ieee80211_hw *hw)
 void rtl88e_dm_init(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u32 cur_igvalue = rtl_get_bbreg(hw, ROFDM0_XAAGCCORE1, 0x7f);
 
         rtlpriv->dm.dm_type = DM_TYPE_BYDRIVER;
-        rtl88e_dm_diginit(hw);
+        rtl_dm_diginit(hw, cur_igvalue);
         rtl88e_dm_init_dynamic_txpower(hw);
         rtl88e_dm_init_edca_turbo(hw);
         rtl88e_dm_init_rate_adaptive_mask(hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/dm.h b/drivers/net/wireless/rtlwifi/rtl8188ee/dm.h
index 64f1f3ea9807..071ccee69eae 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/dm.h
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/dm.h
@@ -186,28 +186,12 @@
 #define BW_AUTO_SWITCH_HIGH_LOW                         25
 #define BW_AUTO_SWITCH_LOW_HIGH                         30
 
-#define DM_DIG_THRESH_HIGH                              40
-#define DM_DIG_THRESH_LOW                               35
-
-#define DM_FALSEALARM_THRESH_LOW                        400
-#define DM_FALSEALARM_THRESH_HIGH                       1000
-
-#define DM_DIG_MAX                                      0x3e
-#define DM_DIG_MIN                                      0x1e
-
-#define DM_DIG_MAX_AP                                   0x32
-#define DM_DIG_MIN_AP                                   0x20
-
 #define DM_DIG_FA_UPPER                                 0x3e
 #define DM_DIG_FA_LOWER                                 0x1e
 #define DM_DIG_FA_TH0                                   0x200
 #define DM_DIG_FA_TH1                                   0x300
 #define DM_DIG_FA_TH2                                   0x400
 
-#define DM_DIG_BACKOFF_MAX                              12
-#define DM_DIG_BACKOFF_MIN                              -4
-#define DM_DIG_BACKOFF_DEFAULT                          10
-
 #define RXPATHSELECTION_SS_TH_W                         30
 #define RXPATHSELECTION_DIFF_TH                         18
 
@@ -262,14 +246,6 @@ enum tag_dynamic_init_gain_operation_type_definition {
         DIG_OP_TYPE_MAX
 };
 
-enum tag_cck_packet_detection_threshold_type_definition {
-        CCK_PD_STAGE_LOWRSSI = 0,
-        CCK_PD_STAGE_HIGHRSSI = 1,
-        CCK_FA_STAGE_LOW = 2,
-        CCK_FA_STAGE_HIGH = 3,
-        CCK_PD_STAGE_MAX = 4,
-};
-
 enum dm_1r_cca_e {
         CCA_1R = 0,
         CCA_2R = 1,
@@ -288,23 +264,6 @@ enum dm_sw_ant_switch_e {
         ANS_ANTENNA_MAX = 3,
 };
 
-enum dm_dig_ext_port_alg_e {
-        DIG_EXT_PORT_STAGE_0 = 0,
-        DIG_EXT_PORT_STAGE_1 = 1,
-        DIG_EXT_PORT_STAGE_2 = 2,
-        DIG_EXT_PORT_STAGE_3 = 3,
-        DIG_EXT_PORT_STAGE_MAX = 4,
-};
-
-enum dm_dig_connect_e {
-        DIG_STA_DISCONNECT = 0,
-        DIG_STA_CONNECT = 1,
-        DIG_STA_BEFORE_CONNECT = 2,
-        DIG_MULTISTA_DISCONNECT = 3,
-        DIG_MULTISTA_CONNECT = 4,
-        DIG_CONNECT_MAX
-};
-
 enum pwr_track_control_method {
         BBSWING,
         TXAGC
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c b/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
index df549c96adef..791efbe6b18c 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
@@ -47,164 +47,6 @@ static u8 _rtl88ee_map_hwqueue_to_fwqueue(struct sk_buff *skb, u8 hw_queue)
         return skb->priority;
 }
 
-/* mac80211's rate_idx is like this:
- *
- * 2.4G band:rx_status->band == IEEE80211_BAND_2GHZ
- *
- * B/G rate:
- * (rx_status->flag & RX_FLAG_HT) = 0,
- * DESC92C_RATE1M-->DESC92C_RATE54M ==> idx is 0-->11,
- *
- * N rate:
- * (rx_status->flag & RX_FLAG_HT) = 1,
- * DESC92C_RATEMCS0-->DESC92C_RATEMCS15 ==> idx is 0-->15
- *
- * 5G band:rx_status->band == IEEE80211_BAND_5GHZ
- * A rate:
- * (rx_status->flag & RX_FLAG_HT) = 0,
- * DESC92C_RATE6M-->DESC92C_RATE54M ==> idx is 0-->7,
- *
- * N rate:
- * (rx_status->flag & RX_FLAG_HT) = 1,
- * DESC92C_RATEMCS0-->DESC92C_RATEMCS15 ==> idx is 0-->15
- */
-static int _rtl88ee_rate_mapping(struct ieee80211_hw *hw,
-                                 bool isht, u8 desc_rate)
-{
-        int rate_idx;
-
-        if (!isht) {
-                if (IEEE80211_BAND_2GHZ == hw->conf.chandef.chan->band) {
-                        switch (desc_rate) {
-                        case DESC92C_RATE1M:
-                                rate_idx = 0;
-                                break;
-                        case DESC92C_RATE2M:
-                                rate_idx = 1;
-                                break;
-                        case DESC92C_RATE5_5M:
-                                rate_idx = 2;
-                                break;
-                        case DESC92C_RATE11M:
-                                rate_idx = 3;
-                                break;
-                        case DESC92C_RATE6M:
-                                rate_idx = 4;
-                                break;
-                        case DESC92C_RATE9M:
-                                rate_idx = 5;
-                                break;
-                        case DESC92C_RATE12M:
-                                rate_idx = 6;
-                                break;
-                        case DESC92C_RATE18M:
-                                rate_idx = 7;
-                                break;
-                        case DESC92C_RATE24M:
-                                rate_idx = 8;
-                                break;
-                        case DESC92C_RATE36M:
-                                rate_idx = 9;
-                                break;
-                        case DESC92C_RATE48M:
-                                rate_idx = 10;
-                                break;
-                        case DESC92C_RATE54M:
-                                rate_idx = 11;
-                                break;
-                        default:
-                                rate_idx = 0;
-                                break;
-                        }
-                } else {
-                        switch (desc_rate) {
-                        case DESC92C_RATE6M:
-                                rate_idx = 0;
-                                break;
-                        case DESC92C_RATE9M:
-                                rate_idx = 1;
-                                break;
-                        case DESC92C_RATE12M:
-                                rate_idx = 2;
-                                break;
-                        case DESC92C_RATE18M:
-                                rate_idx = 3;
-                                break;
-                        case DESC92C_RATE24M:
-                                rate_idx = 4;
-                                break;
-                        case DESC92C_RATE36M:
-                                rate_idx = 5;
-                                break;
-                        case DESC92C_RATE48M:
-                                rate_idx = 6;
-                                break;
-                        case DESC92C_RATE54M:
-                                rate_idx = 7;
-                                break;
-                        default:
-                                rate_idx = 0;
-                                break;
-                        }
-                }
-        } else {
-                switch (desc_rate) {
-                case DESC92C_RATEMCS0:
-                        rate_idx = 0;
-                        break;
-                case DESC92C_RATEMCS1:
-                        rate_idx = 1;
-                        break;
-                case DESC92C_RATEMCS2:
-                        rate_idx = 2;
-                        break;
-                case DESC92C_RATEMCS3:
-                        rate_idx = 3;
-                        break;
-                case DESC92C_RATEMCS4:
-                        rate_idx = 4;
-                        break;
-                case DESC92C_RATEMCS5:
-                        rate_idx = 5;
-                        break;
-                case DESC92C_RATEMCS6:
-                        rate_idx = 6;
-                        break;
-                case DESC92C_RATEMCS7:
-                        rate_idx = 7;
-                        break;
-                case DESC92C_RATEMCS8:
-                        rate_idx = 8;
-                        break;
-                case DESC92C_RATEMCS9:
-                        rate_idx = 9;
-                        break;
-                case DESC92C_RATEMCS10:
-                        rate_idx = 10;
-                        break;
-                case DESC92C_RATEMCS11:
-                        rate_idx = 11;
-                        break;
-                case DESC92C_RATEMCS12:
-                        rate_idx = 12;
-                        break;
-                case DESC92C_RATEMCS13:
-                        rate_idx = 13;
-                        break;
-                case DESC92C_RATEMCS14:
-                        rate_idx = 14;
-                        break;
-                case DESC92C_RATEMCS15:
-                        rate_idx = 15;
-                        break;
-                default:
-                        rate_idx = 0;
-                        break;
-                }
-        }
-        return rate_idx;
-}
-
 static void _rtl88ee_query_rxphystatus(struct ieee80211_hw *hw,
                         struct rtl_stats *pstatus, u8 *pdesc,
                         struct rx_fwinfo_88e *p_drvinfo,
@@ -630,8 +472,8 @@ bool rtl88ee_rx_query_desc(struct ieee80211_hw *hw,
          * are use (RX_FLAG_HT)
          * Notice: this is diff with windows define
          */
-        rx_status->rate_idx = _rtl88ee_rate_mapping(hw,
-                                status->is_ht, status->rate);
+        rx_status->rate_idx = rtlwifi_rate_mapping(hw, status->is_ht,
+                                                   false, status->rate);
 
         rx_status->mactime = status->timestamp_low;
         if (phystatus == true) {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
index f6cb5aedfdd1..f5ee67cda73a 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
@@ -32,6 +32,7 @@
 #include "phy_common.h"
 #include "../pci.h"
 #include "../base.h"
+#include "../core.h"
 
 #define BT_RSSI_STATE_NORMAL_POWER      BIT_OFFSET_LEN_MASK_32(0, 1)
 #define BT_RSSI_STATE_AMDPU_OFF         BIT_OFFSET_LEN_MASK_32(1, 1)
@@ -194,36 +195,6 @@ void dm_savepowerindex(struct ieee80211_hw *hw)
 }
 EXPORT_SYMBOL_GPL(dm_savepowerindex);
 
-static void rtl92c_dm_diginit(struct ieee80211_hw *hw)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct dig_t *dm_digtable = &rtlpriv->dm_digtable;
-
-        dm_digtable->dig_enable_flag = true;
-        dm_digtable->dig_ext_port_stage = DIG_EXT_PORT_STAGE_MAX;
-        dm_digtable->cur_igvalue = 0x20;
-        dm_digtable->pre_igvalue = 0x0;
-        dm_digtable->cursta_cstate = DIG_STA_DISCONNECT;
-        dm_digtable->presta_cstate = DIG_STA_DISCONNECT;
-        dm_digtable->curmultista_cstate = DIG_MULTISTA_DISCONNECT;
-        dm_digtable->rssi_lowthresh = DM_DIG_THRESH_LOW;
-        dm_digtable->rssi_highthresh = DM_DIG_THRESH_HIGH;
-        dm_digtable->fa_lowthresh = DM_FALSEALARM_THRESH_LOW;
-        dm_digtable->fa_highthresh = DM_FALSEALARM_THRESH_HIGH;
-        dm_digtable->rx_gain_max = DM_DIG_MAX;
-        dm_digtable->rx_gain_min = DM_DIG_MIN;
-        dm_digtable->back_val = DM_DIG_BACKOFF_DEFAULT;
-        dm_digtable->back_range_max = DM_DIG_BACKOFF_MAX;
-        dm_digtable->back_range_min = DM_DIG_BACKOFF_MIN;
-        dm_digtable->pre_cck_pd_state = CCK_PD_STAGE_MAX;
-        dm_digtable->cur_cck_pd_state = CCK_PD_STAGE_LowRssi;
-
-        dm_digtable->forbidden_igi = DM_DIG_MIN;
-        dm_digtable->large_fa_hit = 0;
-        dm_digtable->recover_cnt = 0;
-        dm_digtable->dig_dynamic_min  = 0x25;
-}
-
 static u8 rtl92c_dm_initial_gain_min_pwdb(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -507,27 +478,27 @@ static void rtl92c_dm_cck_packet_detection_thresh(struct ieee80211_hw *hw)
                 if (dm_digtable->rssi_val_min > 100)
                         dm_digtable->rssi_val_min = 100;
 
-                if (dm_digtable->pre_cck_pd_state == CCK_PD_STAGE_LowRssi) {
+                if (dm_digtable->pre_cck_pd_state == CCK_PD_STAGE_LOWRSSI) {
                         if (dm_digtable->rssi_val_min <= 25)
                                 dm_digtable->cur_cck_pd_state =
-                                    CCK_PD_STAGE_LowRssi;
+                                    CCK_PD_STAGE_LOWRSSI;
                         else
                                 dm_digtable->cur_cck_pd_state =
-                                    CCK_PD_STAGE_HighRssi;
+                                    CCK_PD_STAGE_HIGHRSSI;
                 } else {
                         if (dm_digtable->rssi_val_min <= 20)
                                 dm_digtable->cur_cck_pd_state =
-                                    CCK_PD_STAGE_LowRssi;
+                                    CCK_PD_STAGE_LOWRSSI;
                         else
                                 dm_digtable->cur_cck_pd_state =
-                                    CCK_PD_STAGE_HighRssi;
+                                    CCK_PD_STAGE_HIGHRSSI;
                 }
         } else {
                 dm_digtable->cur_cck_pd_state = CCK_PD_STAGE_MAX;
         }
 
         if (dm_digtable->pre_cck_pd_state != dm_digtable->cur_cck_pd_state) {
-                if ((dm_digtable->cur_cck_pd_state == CCK_PD_STAGE_LowRssi) ||
+                if ((dm_digtable->cur_cck_pd_state == CCK_PD_STAGE_LOWRSSI) ||
                     (dm_digtable->cur_cck_pd_state == CCK_PD_STAGE_MAX))
                         rtl_set_bbreg(hw, RCCK0_CCA, MASKBYTE2, 0x83);
                 else
@@ -1374,7 +1345,7 @@ void rtl92c_dm_init(struct ieee80211_hw *hw)
         rtlpriv->dm.undec_sm_pwdb = -1;
         rtlpriv->dm.undec_sm_cck = -1;
         rtlpriv->dm.dm_initialgain_enable = true;
-        rtl92c_dm_diginit(hw);
+        rtl_dm_diginit(hw, 0x20);
 
         rtlpriv->dm.dm_flag |= HAL_DM_HIPWR_DISABLE;
         rtl92c_dm_init_dynamic_txpower(hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h
index 4f232a063636..4422e31fedd9 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h
@@ -47,25 +47,12 @@
 #define BW_AUTO_SWITCH_HIGH_LOW                 25
 #define BW_AUTO_SWITCH_LOW_HIGH                 30
 
-#define DM_DIG_THRESH_HIGH                      40
-#define DM_DIG_THRESH_LOW                       35
-
-#define DM_FALSEALARM_THRESH_LOW                400
-#define DM_FALSEALARM_THRESH_HIGH               1000
-
-#define DM_DIG_MAX                              0x3e
-#define DM_DIG_MIN                              0x1e
-
 #define DM_DIG_FA_UPPER                         0x32
 #define DM_DIG_FA_LOWER                         0x20
 #define DM_DIG_FA_TH0                           0x20
 #define DM_DIG_FA_TH1                           0x100
 #define DM_DIG_FA_TH2                           0x200
 
-#define DM_DIG_BACKOFF_MAX                      12
-#define DM_DIG_BACKOFF_MIN                      -4
-#define DM_DIG_BACKOFF_DEFAULT                  10
-
 #define RXPATHSELECTION_SS_TH_lOW               30
 #define RXPATHSELECTION_DIFF_TH                 18
 
@@ -123,14 +110,6 @@ enum tag_dynamic_init_gain_operation_type_definition {
         DIG_OP_TYPE_MAX
 };
 
-enum tag_cck_packet_detection_threshold_type_definition {
-        CCK_PD_STAGE_LowRssi = 0,
-        CCK_PD_STAGE_HighRssi = 1,
-        CCK_FA_STAGE_Low = 2,
-        CCK_FA_STAGE_High = 3,
-        CCK_PD_STAGE_MAX = 4,
-};
-
 enum dm_1r_cca_e {
         CCA_1R = 0,
         CCA_2R = 1,
@@ -149,23 +128,6 @@ enum dm_sw_ant_switch_e {
         ANS_ANTENNA_MAX = 3,
 };
 
-enum dm_dig_ext_port_alg_e {
-        DIG_EXT_PORT_STAGE_0 = 0,
-        DIG_EXT_PORT_STAGE_1 = 1,
-        DIG_EXT_PORT_STAGE_2 = 2,
-        DIG_EXT_PORT_STAGE_3 = 3,
-        DIG_EXT_PORT_STAGE_MAX = 4,
-};
-
-enum dm_dig_connect_e {
-        DIG_STA_DISCONNECT = 0,
-        DIG_STA_CONNECT = 1,
-        DIG_STA_BEFORE_CONNECT = 2,
-        DIG_MULTISTA_DISCONNECT = 3,
-        DIG_MULTISTA_CONNECT = 4,
-        DIG_CONNECT_MAX
-};
-
 void rtl92c_dm_init(struct ieee80211_hw *hw);
 void rtl92c_dm_watchdog(struct ieee80211_hw *hw);
 void rtl92c_dm_write_dig(struct ieee80211_hw *hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h
index b64ae45dc674..e9f4281f5067 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h
@@ -37,6 +37,7 @@
 #define FW_8192C_POLLING_DELAY                  5
 #define FW_8192C_POLLING_TIMEOUT_COUNT          100
 #define NORMAL_CHIP                             BIT(4)
+#define H2C_92C_KEEP_ALIVE_CTRL                 48
 
 #define IS_FW_HEADER_EXIST(_pfwhdr)     \
         ((le16_to_cpu(_pfwhdr->signature)&0xFFF0) == 0x92C0 ||\
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/dm.c b/drivers/net/wireless/rtlwifi/rtl8192ce/dm.c
index 74f9c083b80d..09898cf2e07a 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/dm.c
@@ -30,6 +30,7 @@
 #include "../wifi.h"
 #include "../base.h"
 #include "../pci.h"
+#include "../core.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/dm.h b/drivers/net/wireless/rtlwifi/rtl8192ce/dm.h
index 9c5311c299fd..38ba707015f5 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/dm.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/dm.h
@@ -42,25 +42,12 @@
 #define BW_AUTO_SWITCH_HIGH_LOW                 25
 #define BW_AUTO_SWITCH_LOW_HIGH                 30
 
-#define DM_DIG_THRESH_HIGH                      40
-#define DM_DIG_THRESH_LOW                       35
-
-#define DM_FALSEALARM_THRESH_LOW                400
-#define DM_FALSEALARM_THRESH_HIGH               1000
-
-#define DM_DIG_MAX                              0x3e
-#define DM_DIG_MIN                              0x1e
-
 #define DM_DIG_FA_UPPER                         0x32
 #define DM_DIG_FA_LOWER                         0x20
 #define DM_DIG_FA_TH0                           0x20
 #define DM_DIG_FA_TH1                           0x100
 #define DM_DIG_FA_TH2                           0x200
 
-#define DM_DIG_BACKOFF_MAX                      12
-#define DM_DIG_BACKOFF_MIN                      -4
-#define DM_DIG_BACKOFF_DEFAULT                  10
-
 #define RXPATHSELECTION_SS_TH_lOW               30
 #define RXPATHSELECTION_DIFF_TH                 18
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
index 5c646d5f7bb8..303b299376c9 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
@@ -544,8 +544,13 @@ void rtl92ce_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
                                                 (u8 *)(&fw_current_inps));
                         }
                 break; }
-        case HW_VAR_KEEP_ALIVE:
-                break;
+        case HW_VAR_KEEP_ALIVE: {
+                u8 array[2];
+
+                array[0] = 0xff;
+                array[1] = *((u8 *)val);
+                rtl92c_fill_h2c_cmd(hw, H2C_92C_KEEP_ALIVE_CTRL, 2, array);
+                break; }
         default:
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
                          "switch case %d not processed\n", variable);
@@ -1156,47 +1161,35 @@ static int _rtl92ce_set_media_status(struct ieee80211_hw *hw,
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         u8 bt_msr = rtl_read_byte(rtlpriv, MSR);
         enum led_ctl_mode ledaction = LED_CTL_NO_LINK;
-        bt_msr &= 0xfc;
+        u8 mode = MSR_NOLINK;
 
-        if (type == NL80211_IFTYPE_UNSPECIFIED ||
-            type == NL80211_IFTYPE_STATION) {
-                _rtl92ce_stop_tx_beacon(hw);
-                _rtl92ce_enable_bcn_sub_func(hw);
-        } else if (type == NL80211_IFTYPE_ADHOC || type == NL80211_IFTYPE_AP ||
-                   type == NL80211_IFTYPE_MESH_POINT) {
-                _rtl92ce_resume_tx_beacon(hw);
-                _rtl92ce_disable_bcn_sub_func(hw);
-        } else {
-                RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
-                         "Set HW_VAR_MEDIA_STATUS: No such media status(%x)\n",
-                         type);
-        }
+        bt_msr &= 0xfc;
 
         switch (type) {
         case NL80211_IFTYPE_UNSPECIFIED:
-                bt_msr |= MSR_NOLINK;
-                ledaction = LED_CTL_LINK;
+                mode = MSR_NOLINK;
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
                          "Set Network type to NO LINK!\n");
                 break;
         case NL80211_IFTYPE_ADHOC:
-                bt_msr |= MSR_ADHOC;
+                mode = MSR_ADHOC;
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
                          "Set Network type to Ad Hoc!\n");
                 break;
         case NL80211_IFTYPE_STATION:
-                bt_msr |= MSR_INFRA;
+                mode = MSR_INFRA;
                 ledaction = LED_CTL_LINK;
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
                          "Set Network type to STA!\n");
                 break;
         case NL80211_IFTYPE_AP:
-                bt_msr |= MSR_AP;
+                mode = MSR_AP;
+                ledaction = LED_CTL_LINK;
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
                          "Set Network type to AP!\n");
                 break;
         case NL80211_IFTYPE_MESH_POINT:
-                bt_msr |= MSR_ADHOC;
+                mode = MSR_ADHOC;
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
                          "Set Network type to Mesh Point!\n");
                 break;
@@ -1207,9 +1200,32 @@ static int _rtl92ce_set_media_status(struct ieee80211_hw *hw,
 
         }
 
-        rtl_write_byte(rtlpriv, (MSR), bt_msr);
+        /* MSR_INFRA == Link in infrastructure network;
+         * MSR_ADHOC == Link in ad hoc network;
+         * Therefore, check link state is necessary.
+         *
+         * MSR_AP == AP mode; link state does not matter here.
+         */
+        if (mode != MSR_AP &&
+            rtlpriv->mac80211.link_state < MAC80211_LINKED) {
+                mode = MSR_NOLINK;
+                ledaction = LED_CTL_NO_LINK;
+        }
+        if (mode == MSR_NOLINK || mode == MSR_INFRA) {
+                _rtl92ce_stop_tx_beacon(hw);
+                _rtl92ce_enable_bcn_sub_func(hw);
+        } else if (mode == MSR_ADHOC || mode == MSR_AP) {
+                _rtl92ce_resume_tx_beacon(hw);
+                _rtl92ce_disable_bcn_sub_func(hw);
+        } else {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+                         "Set HW_VAR_MEDIA_STATUS: No such media status(%x).\n",
+                         mode);
+        }
+        rtl_write_byte(rtlpriv, MSR, bt_msr | mode);
+
         rtlpriv->cfg->ops->led_control(hw, ledaction);
-        if ((bt_msr & MSR_MASK) == MSR_AP)
+        if (mode == MSR_AP)
                 rtl_write_byte(rtlpriv, REG_BCNTCFG + 1, 0x00);
         else
                 rtl_write_byte(rtlpriv, REG_BCNTCFG + 1, 0x66);
@@ -1833,7 +1849,6 @@ static void rtl92ce_update_hal_rate_table(struct ieee80211_hw *hw,
         u32 ratr_value;
         u8 ratr_index = 0;
         u8 nmode = mac->ht_enable;
-        u8 mimo_ps = IEEE80211_SMPS_OFF;
         u16 shortgi_rate;
         u32 tmp_ratr_value;
         u8 curtxbw_40mhz = mac->bw_40;
@@ -1842,6 +1857,7 @@ static void rtl92ce_update_hal_rate_table(struct ieee80211_hw *hw,
         u8 curshortgi_20mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20) ?
                                1 : 0;
         enum wireless_mode wirelessmode = mac->mode;
+        u32 ratr_mask;
 
         if (rtlhal->current_bandtype == BAND_ON_5G)
                 ratr_value = sta->supp_rates[1] << 4;
@@ -1865,19 +1881,13 @@ static void rtl92ce_update_hal_rate_table(struct ieee80211_hw *hw,
         case WIRELESS_MODE_N_24G:
         case WIRELESS_MODE_N_5G:
                 nmode = 1;
-                if (mimo_ps == IEEE80211_SMPS_STATIC) {
-                        ratr_value &= 0x0007F005;
-                } else {
-                        u32 ratr_mask;
-
-                        if (get_rf_type(rtlphy) == RF_1T2R ||
-                            get_rf_type(rtlphy) == RF_1T1R)
-                                ratr_mask = 0x000ff005;
-                        else
-                                ratr_mask = 0x0f0ff005;
+                if (get_rf_type(rtlphy) == RF_1T2R ||
+                    get_rf_type(rtlphy) == RF_1T1R)
+                        ratr_mask = 0x000ff005;
+                else
+                        ratr_mask = 0x0f0ff005;
 
-                        ratr_value &= ratr_mask;
-                }
+                ratr_value &= ratr_mask;
                 break;
         default:
                 if (rtlphy->rf_type == RF_1T2R)
@@ -1930,17 +1940,16 @@ static void rtl92ce_update_hal_rate_mask(struct ieee80211_hw *hw,
         struct rtl_sta_info *sta_entry = NULL;
         u32 ratr_bitmap;
         u8 ratr_index;
-        u8 curtxbw_40mhz = (sta->bandwidth >= IEEE80211_STA_RX_BW_40) ? 1 : 0;
-        u8 curshortgi_40mhz = curtxbw_40mhz &&
-                              (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40) ?
-                                1 : 0;
+        u8 curtxbw_40mhz = (sta->ht_cap.cap &
+                            IEEE80211_HT_CAP_SUP_WIDTH_20_40) ? 1 : 0;
+        u8 curshortgi_40mhz = (sta->ht_cap.cap &
+                               IEEE80211_HT_CAP_SGI_40) ?  1 : 0;
         u8 curshortgi_20mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20) ?
                                 1 : 0;
         enum wireless_mode wirelessmode = 0;
         bool shortgi = false;
         u8 rate_mask[5];
         u8 macid = 0;
-        u8 mimo_ps = IEEE80211_SMPS_OFF;
 
         sta_entry = (struct rtl_sta_info *) sta->drv_priv;
         wirelessmode = sta_entry->wireless_mode;
@@ -1985,47 +1994,38 @@ static void rtl92ce_update_hal_rate_mask(struct ieee80211_hw *hw,
         case WIRELESS_MODE_N_5G:
                 ratr_index = RATR_INX_WIRELESS_NGB;
 
-                if (mimo_ps == IEEE80211_SMPS_STATIC) {
-                        if (rssi_level == 1)
-                                ratr_bitmap &= 0x00070000;
-                        else if (rssi_level == 2)
-                                ratr_bitmap &= 0x0007f000;
-                        else
-                                ratr_bitmap &= 0x0007f005;
+                if (rtlphy->rf_type == RF_1T2R ||
+                    rtlphy->rf_type == RF_1T1R) {
+                        if (curtxbw_40mhz) {
+                                if (rssi_level == 1)
+                                        ratr_bitmap &= 0x000f0000;
+                                else if (rssi_level == 2)
+                                        ratr_bitmap &= 0x000ff000;
+                                else
+                                        ratr_bitmap &= 0x000ff015;
+                        } else {
+                                if (rssi_level == 1)
+                                        ratr_bitmap &= 0x000f0000;
+                                else if (rssi_level == 2)
+                                        ratr_bitmap &= 0x000ff000;
+                                else
+                                        ratr_bitmap &= 0x000ff005;
+                        }
                 } else {
-                        if (rtlphy->rf_type == RF_1T2R ||
-                            rtlphy->rf_type == RF_1T1R) {
-                                if (curtxbw_40mhz) {
-                                        if (rssi_level == 1)
-                                                ratr_bitmap &= 0x000f0000;
-                                        else if (rssi_level == 2)
-                                                ratr_bitmap &= 0x000ff000;
-                                        else
-                                                ratr_bitmap &= 0x000ff015;
-                                } else {
-                                        if (rssi_level == 1)
-                                                ratr_bitmap &= 0x000f0000;
-                                        else if (rssi_level == 2)
-                                                ratr_bitmap &= 0x000ff000;
-                                        else
-                                                ratr_bitmap &= 0x000ff005;
-                                }
+                        if (curtxbw_40mhz) {
+                                if (rssi_level == 1)
+                                        ratr_bitmap &= 0x0f0f0000;
+                                else if (rssi_level == 2)
+                                        ratr_bitmap &= 0x0f0ff000;
+                                else
+                                        ratr_bitmap &= 0x0f0ff015;
                         } else {
-                                if (curtxbw_40mhz) {
-                                        if (rssi_level == 1)
-                                                ratr_bitmap &= 0x0f0f0000;
-                                        else if (rssi_level == 2)
-                                                ratr_bitmap &= 0x0f0ff000;
-                                        else
-                                                ratr_bitmap &= 0x0f0ff015;
-                                } else {
-                                        if (rssi_level == 1)
-                                                ratr_bitmap &= 0x0f0f0000;
-                                        else if (rssi_level == 2)
-                                                ratr_bitmap &= 0x0f0ff000;
-                                        else
-                                                ratr_bitmap &= 0x0f0ff005;
-                                }
+                                if (rssi_level == 1)
+                                        ratr_bitmap &= 0x0f0f0000;
+                                else if (rssi_level == 2)
+                                        ratr_bitmap &= 0x0f0ff000;
+                                else
+                                        ratr_bitmap &= 0x0f0ff005;
                         }
                 }
 
@@ -2058,9 +2058,6 @@ static void rtl92ce_update_hal_rate_mask(struct ieee80211_hw *hw,
                  "Rate_index:%x, ratr_val:%x, %5phC\n",
                  ratr_index, ratr_bitmap, rate_mask);
         rtl92c_fill_h2c_cmd(hw, H2C_RA_MASK, 5, rate_mask);
-
-        if (macid != 0)
-                sta_entry->ratr_index = ratr_index;
 }
 
 void rtl92ce_update_hal_rate_tbl(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/phy.c b/drivers/net/wireless/rtlwifi/rtl8192ce/phy.c
index bc5ca989b915..1ee5a6ae9960 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/phy.c
@@ -518,11 +518,12 @@ static bool _rtl92ce_phy_set_rf_power_state(struct ieee80211_hw *hw,
                 }
         case ERFSLEEP:{
                         if (ppsc->rfpwr_state == ERFOFF)
-                                return false;
+                                break;
                         for (queue_id = 0, i = 0;
                              queue_id < RTL_PCI_MAX_TX_QUEUE_COUNT;) {
                                 ring = &pcipriv->dev.tx_ring[queue_id];
-                                if (skb_queue_len(&ring->queue) == 0) {
+                                if (queue_id == BEACON_QUEUE ||
+                                    skb_queue_len(&ring->queue) == 0) {
                                         queue_id++;
                                         continue;
                                 } else {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
index dd5aa089126a..de6cb6c3a48c 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
@@ -334,21 +334,21 @@ static struct rtl_hal_cfg rtl92ce_hal_cfg = {
         .maps[RTL_IMR_ROK] = IMR_ROK,
         .maps[RTL_IBSS_INT_MASKS] = (IMR_BCNINT | IMR_TBDOK | IMR_TBDER),
 
-        .maps[RTL_RC_CCK_RATE1M] = DESC92_RATE1M,
-        .maps[RTL_RC_CCK_RATE2M] = DESC92_RATE2M,
-        .maps[RTL_RC_CCK_RATE5_5M] = DESC92_RATE5_5M,
-        .maps[RTL_RC_CCK_RATE11M] = DESC92_RATE11M,
-        .maps[RTL_RC_OFDM_RATE6M] = DESC92_RATE6M,
-        .maps[RTL_RC_OFDM_RATE9M] = DESC92_RATE9M,
-        .maps[RTL_RC_OFDM_RATE12M] = DESC92_RATE12M,
-        .maps[RTL_RC_OFDM_RATE18M] = DESC92_RATE18M,
-        .maps[RTL_RC_OFDM_RATE24M] = DESC92_RATE24M,
-        .maps[RTL_RC_OFDM_RATE36M] = DESC92_RATE36M,
-        .maps[RTL_RC_OFDM_RATE48M] = DESC92_RATE48M,
-        .maps[RTL_RC_OFDM_RATE54M] = DESC92_RATE54M,
-
-        .maps[RTL_RC_HT_RATEMCS7] = DESC92_RATEMCS7,
-        .maps[RTL_RC_HT_RATEMCS15] = DESC92_RATEMCS15,
+        .maps[RTL_RC_CCK_RATE1M] = DESC_RATE1M,
+        .maps[RTL_RC_CCK_RATE2M] = DESC_RATE2M,
+        .maps[RTL_RC_CCK_RATE5_5M] = DESC_RATE5_5M,
+        .maps[RTL_RC_CCK_RATE11M] = DESC_RATE11M,
+        .maps[RTL_RC_OFDM_RATE6M] = DESC_RATE6M,
+        .maps[RTL_RC_OFDM_RATE9M] = DESC_RATE9M,
+        .maps[RTL_RC_OFDM_RATE12M] = DESC_RATE12M,
+        .maps[RTL_RC_OFDM_RATE18M] = DESC_RATE18M,
+        .maps[RTL_RC_OFDM_RATE24M] = DESC_RATE24M,
+        .maps[RTL_RC_OFDM_RATE36M] = DESC_RATE36M,
+        .maps[RTL_RC_OFDM_RATE48M] = DESC_RATE48M,
+        .maps[RTL_RC_OFDM_RATE54M] = DESC_RATE54M,
+
+        .maps[RTL_RC_HT_RATEMCS7] = DESC_RATEMCS7,
+        .maps[RTL_RC_HT_RATEMCS15] = DESC_RATEMCS15,
 };
 
 static const struct pci_device_id rtl92ce_pci_ids[] = {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
index e88dcd0e0af1..84ddd4d07a1d 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
@@ -257,8 +257,8 @@ static void _rtl92ce_query_rxphystatus(struct ieee80211_hw *hw,
                 pstats->recvsignalpower = rx_pwr_all;
 
                 /* (3)EVM of HT rate */
-                if (pstats->is_ht && pstats->rate >= DESC92_RATEMCS8 &&
-                    pstats->rate <= DESC92_RATEMCS15)
+                if (pstats->is_ht && pstats->rate >= DESC_RATEMCS8 &&
+                    pstats->rate <= DESC_RATEMCS15)
                         max_spatial_stream = 2;
                 else
                         max_spatial_stream = 1;
@@ -400,9 +400,8 @@ bool rtl92ce_rx_query_desc(struct ieee80211_hw *hw,
          * are use (RX_FLAG_HT)
          * Notice: this is diff with windows define
          */
-        rx_status->rate_idx = rtlwifi_rate_mapping(hw,
-                                stats->is_ht, stats->rate,
-                                stats->isfirst_ampdu);
+        rx_status->rate_idx = rtlwifi_rate_mapping(hw, stats->is_ht,
+                                                   false, stats->rate);
 
         rx_status->mactime = stats->timestamp_low;
         if (phystatus) {
@@ -501,7 +500,7 @@ void rtl92ce_tx_fill_desc(struct ieee80211_hw *hw,
                 SET_TX_DESC_RTS_BW(pdesc, 0);
                 SET_TX_DESC_RTS_SC(pdesc, tcb_desc->rts_sc);
                 SET_TX_DESC_RTS_SHORT(pdesc,
-                                      ((tcb_desc->rts_rate <= DESC92_RATE54M) ?
+                                      ((tcb_desc->rts_rate <= DESC_RATE54M) ?
                                        (tcb_desc->rts_use_shortpreamble ? 1 : 0)
                                        : (tcb_desc->rts_use_shortgi ? 1 : 0)));
 
@@ -624,7 +623,7 @@ void rtl92ce_tx_fill_cmddesc(struct ieee80211_hw *hw,
         if (firstseg)
                 SET_TX_DESC_OFFSET(pdesc, USB_HWDESC_HEADER_LEN);
 
-        SET_TX_DESC_TX_RATE(pdesc, DESC92_RATE1M);
+        SET_TX_DESC_TX_RATE(pdesc, DESC_RATE1M);
 
         SET_TX_DESC_SEQ(pdesc, 0);
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
index 551321728ae0..fe4b699a12f5 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
@@ -1000,6 +1000,7 @@ int rtl92cu_hw_init(struct ieee80211_hw *hw)
         local_save_flags(flags);
         local_irq_enable();
 
+        rtlhal->fw_ready = false;
         rtlhal->hw_type = HARDWARE_TYPE_RTL8192CU;
         err = _rtl92cu_init_mac(hw);
         if (err) {
@@ -1013,6 +1014,8 @@ int rtl92cu_hw_init(struct ieee80211_hw *hw)
                 err = 1;
                 goto exit;
         }
+
+        rtlhal->fw_ready = true;
         rtlhal->last_hmeboxnum = 0; /* h2c */
         _rtl92cu_phy_param_tab_init(hw);
         rtl92cu_phy_mac_config(hw);
@@ -1509,6 +1512,7 @@ void rtl92cu_set_beacon_related_registers(struct ieee80211_hw *hw)
         /* TODO: Modify later (Find the right parameters)
          * NOTE: Fix test chip's bug (about contention windows's randomness) */
         if ((mac->opmode == NL80211_IFTYPE_ADHOC) ||
+            (mac->opmode == NL80211_IFTYPE_MESH_POINT) ||
             (mac->opmode == NL80211_IFTYPE_AP)) {
                 rtl_write_byte(rtlpriv, REG_RXTSF_OFFSET_CCK, 0x50);
                 rtl_write_byte(rtlpriv, REG_RXTSF_OFFSET_OFDM, 0x50);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c b/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
index c2d8ec6afcda..133e395b7401 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
@@ -880,8 +880,8 @@ static void _rtl92c_query_rxphystatus(struct ieee80211_hw *hw,
                 pstats->rxpower = rx_pwr_all;
                 pstats->recvsignalpower = rx_pwr_all;
                 if (GET_RX_DESC_RX_MCS(pdesc) &&
-                    GET_RX_DESC_RX_MCS(pdesc) >= DESC92_RATEMCS8 &&
-                    GET_RX_DESC_RX_MCS(pdesc) <= DESC92_RATEMCS15)
+                    GET_RX_DESC_RX_MCS(pdesc) >= DESC_RATEMCS8 &&
+                    GET_RX_DESC_RX_MCS(pdesc) <= DESC_RATEMCS15)
                         max_spatial_stream = 2;
                 else
                         max_spatial_stream = 1;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
index e06bafee37f9..90a714c189a8 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -257,20 +257,20 @@ static struct rtl_hal_cfg rtl92cu_hal_cfg = {
         .maps[RTL_IMR_ROK] = IMR_ROK,
         .maps[RTL_IBSS_INT_MASKS] = (IMR_BCNINT | IMR_TBDOK | IMR_TBDER),
 
-        .maps[RTL_RC_CCK_RATE1M] = DESC92_RATE1M,
-        .maps[RTL_RC_CCK_RATE2M] = DESC92_RATE2M,
-        .maps[RTL_RC_CCK_RATE5_5M] = DESC92_RATE5_5M,
-        .maps[RTL_RC_CCK_RATE11M] = DESC92_RATE11M,
-        .maps[RTL_RC_OFDM_RATE6M] = DESC92_RATE6M,
-        .maps[RTL_RC_OFDM_RATE9M] = DESC92_RATE9M,
-        .maps[RTL_RC_OFDM_RATE12M] = DESC92_RATE12M,
-        .maps[RTL_RC_OFDM_RATE18M] = DESC92_RATE18M,
-        .maps[RTL_RC_OFDM_RATE24M] = DESC92_RATE24M,
-        .maps[RTL_RC_OFDM_RATE36M] = DESC92_RATE36M,
-        .maps[RTL_RC_OFDM_RATE48M] = DESC92_RATE48M,
-        .maps[RTL_RC_OFDM_RATE54M] = DESC92_RATE54M,
-        .maps[RTL_RC_HT_RATEMCS7] = DESC92_RATEMCS7,
-        .maps[RTL_RC_HT_RATEMCS15] = DESC92_RATEMCS15,
+        .maps[RTL_RC_CCK_RATE1M] = DESC_RATE1M,
+        .maps[RTL_RC_CCK_RATE2M] = DESC_RATE2M,
+        .maps[RTL_RC_CCK_RATE5_5M] = DESC_RATE5_5M,
+        .maps[RTL_RC_CCK_RATE11M] = DESC_RATE11M,
+        .maps[RTL_RC_OFDM_RATE6M] = DESC_RATE6M,
+        .maps[RTL_RC_OFDM_RATE9M] = DESC_RATE9M,
+        .maps[RTL_RC_OFDM_RATE12M] = DESC_RATE12M,
+        .maps[RTL_RC_OFDM_RATE18M] = DESC_RATE18M,
+        .maps[RTL_RC_OFDM_RATE24M] = DESC_RATE24M,
+        .maps[RTL_RC_OFDM_RATE36M] = DESC_RATE36M,
+        .maps[RTL_RC_OFDM_RATE48M] = DESC_RATE48M,
+        .maps[RTL_RC_OFDM_RATE54M] = DESC_RATE54M,
+        .maps[RTL_RC_HT_RATEMCS7] = DESC_RATEMCS7,
+        .maps[RTL_RC_HT_RATEMCS15] = DESC_RATEMCS15,
 };
 
 #define USB_VENDER_ID_REALTEK           0x0bda
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
index f383d5f1fed5..cbead007171f 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
@@ -325,6 +325,7 @@ bool rtl92cu_rx_query_desc(struct ieee80211_hw *hw,
                                    && (GET_RX_DESC_FAGGR(pdesc) == 1));
         stats->timestamp_low = GET_RX_DESC_TSFL(pdesc);
         stats->rx_is40Mhzpacket = (bool) GET_RX_DESC_BW(pdesc);
+        stats->is_ht = (bool)GET_RX_DESC_RX_HT(pdesc);
         rx_status->freq = hw->conf.chandef.chan->center_freq;
         rx_status->band = hw->conf.chandef.chan->band;
         if (GET_RX_DESC_CRC32(pdesc))
@@ -338,10 +339,8 @@ bool rtl92cu_rx_query_desc(struct ieee80211_hw *hw,
         rx_status->flag |= RX_FLAG_MACTIME_START;
         if (stats->decrypted)
                 rx_status->flag |= RX_FLAG_DECRYPTED;
-        rx_status->rate_idx = rtlwifi_rate_mapping(hw,
-                                        (bool)GET_RX_DESC_RX_HT(pdesc),
-                                        (u8)GET_RX_DESC_RX_MCS(pdesc),
-                                        (bool)GET_RX_DESC_PAGGR(pdesc));
+        rx_status->rate_idx = rtlwifi_rate_mapping(hw, stats->is_ht,
+                                                   false, stats->rate);
         rx_status->mactime = GET_RX_DESC_TSFL(pdesc);
         if (phystatus) {
                 p_drvinfo = (struct rx_fwinfo_92c *)(skb->data +
@@ -393,6 +392,7 @@ static void _rtl_rx_process(struct ieee80211_hw *hw, struct sk_buff *skb)
                                    && (GET_RX_DESC_FAGGR(rxdesc) == 1));
         stats.timestamp_low = GET_RX_DESC_TSFL(rxdesc);
         stats.rx_is40Mhzpacket = (bool) GET_RX_DESC_BW(rxdesc);
+        stats.is_ht = (bool)GET_RX_DESC_RX_HT(rxdesc);
         /* TODO: is center_freq changed when doing scan? */
         /* TODO: Shall we add protection or just skip those two step? */
         rx_status->freq = hw->conf.chandef.chan->center_freq;
@@ -406,10 +406,8 @@ static void _rtl_rx_process(struct ieee80211_hw *hw, struct sk_buff *skb)
         if (GET_RX_DESC_RX_HT(rxdesc))
                 rx_status->flag |= RX_FLAG_HT;
         /* Data rate */
-        rx_status->rate_idx = rtlwifi_rate_mapping(hw,
-                                        (bool)GET_RX_DESC_RX_HT(rxdesc),
-                                        (u8)GET_RX_DESC_RX_MCS(rxdesc),
-                                        (bool)GET_RX_DESC_PAGGR(rxdesc));
+        rx_status->rate_idx = rtlwifi_rate_mapping(hw, stats.is_ht,
+                                                   false, stats.rate);
         /*  There is a phy status after this rx descriptor. */
         if (GET_RX_DESC_PHY_STATUS(rxdesc)) {
                 p_drvinfo = (struct rx_fwinfo_92c *)(rxdesc + RTL_RX_DESC_SIZE);
@@ -545,7 +543,7 @@ void rtl92cu_tx_fill_desc(struct ieee80211_hw *hw,
         SET_TX_DESC_RTS_BW(txdesc, 0);
         SET_TX_DESC_RTS_SC(txdesc, tcb_desc->rts_sc);
         SET_TX_DESC_RTS_SHORT(txdesc,
-                              ((tcb_desc->rts_rate <= DESC92_RATE54M) ?
+                              ((tcb_desc->rts_rate <= DESC_RATE54M) ?
                                (tcb_desc->rts_use_shortpreamble ? 1 : 0)
                                : (tcb_desc->rts_use_shortgi ? 1 : 0)));
         if (mac->bw_40) {
@@ -644,7 +642,7 @@ void rtl92cu_fill_fake_txdesc(struct ieee80211_hw *hw, u8 * pDesc,
         }
         SET_TX_DESC_USE_RATE(pDesc, 1); /* use data rate which is set by Sw */
         SET_TX_DESC_OWN(pDesc, 1);
-        SET_TX_DESC_TX_RATE(pDesc, DESC92_RATE1M);
+        SET_TX_DESC_TX_RATE(pDesc, DESC_RATE1M);
         _rtl_tx_desc_checksum(pDesc);
 }
 
@@ -660,7 +658,7 @@ void rtl92cu_tx_fill_cmddesc(struct ieee80211_hw *hw,
         memset((void *)pdesc, 0, RTL_TX_HEADER_SIZE);
         if (firstseg)
                 SET_TX_DESC_OFFSET(pdesc, RTL_TX_HEADER_SIZE);
-        SET_TX_DESC_TX_RATE(pdesc, DESC92_RATE1M);
+        SET_TX_DESC_TX_RATE(pdesc, DESC_RATE1M);
         SET_TX_DESC_SEQ(pdesc, 0);
         SET_TX_DESC_LINIP(pdesc, 0);
         SET_TX_DESC_QUEUE_SEL(pdesc, fw_queue);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/dm.c b/drivers/net/wireless/rtlwifi/rtl8192de/dm.c
index 304c443b89b2..a1be5a68edfb 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/dm.c
@@ -29,6 +29,7 @@
 
 #include "../wifi.h"
 #include "../base.h"
+#include "../core.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -155,34 +156,6 @@ static const u8 cckswing_table_ch14[CCK_TABLE_SIZE][8] = {
         {0x09, 0x08, 0x07, 0x04, 0x00, 0x00, 0x00, 0x00}     /* 32, -16.0dB */
 };
 
-static void rtl92d_dm_diginit(struct ieee80211_hw *hw)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct dig_t *de_digtable = &rtlpriv->dm_digtable;
-
-        de_digtable->dig_enable_flag = true;
-        de_digtable->dig_ext_port_stage = DIG_EXT_PORT_STAGE_MAX;
-        de_digtable->cur_igvalue = 0x20;
-        de_digtable->pre_igvalue = 0x0;
-        de_digtable->cursta_cstate = DIG_STA_DISCONNECT;
-        de_digtable->presta_cstate = DIG_STA_DISCONNECT;
-        de_digtable->curmultista_cstate = DIG_MULTISTA_DISCONNECT;
-        de_digtable->rssi_lowthresh = DM_DIG_THRESH_LOW;
-        de_digtable->rssi_highthresh = DM_DIG_THRESH_HIGH;
-        de_digtable->fa_lowthresh = DM_FALSEALARM_THRESH_LOW;
-        de_digtable->fa_highthresh = DM_FALSEALARM_THRESH_HIGH;
-        de_digtable->rx_gain_max = DM_DIG_FA_UPPER;
-        de_digtable->rx_gain_min = DM_DIG_FA_LOWER;
-        de_digtable->back_val = DM_DIG_BACKOFF_DEFAULT;
-        de_digtable->back_range_max = DM_DIG_BACKOFF_MAX;
-        de_digtable->back_range_min = DM_DIG_BACKOFF_MIN;
-        de_digtable->pre_cck_pd_state = CCK_PD_STAGE_LOWRSSI;
-        de_digtable->cur_cck_pd_state = CCK_PD_STAGE_MAX;
-        de_digtable->large_fa_hit = 0;
-        de_digtable->recover_cnt = 0;
-        de_digtable->forbidden_igi = DM_DIG_FA_LOWER;
-}
-
 static void rtl92d_dm_false_alarm_counter_statistics(struct ieee80211_hw *hw)
 {
         u32 ret_value;
@@ -1305,7 +1278,9 @@ void rtl92d_dm_init(struct ieee80211_hw *hw)
         struct rtl_priv *rtlpriv = rtl_priv(hw);
 
         rtlpriv->dm.dm_type = DM_TYPE_BYDRIVER;
-        rtl92d_dm_diginit(hw);
+        rtl_dm_diginit(hw, 0x20);
+        rtlpriv->dm_digtable.rx_gain_max = DM_DIG_FA_UPPER;
+        rtlpriv->dm_digtable.rx_gain_min = DM_DIG_FA_LOWER;
         rtl92d_dm_init_dynamic_txpower(hw);
         rtl92d_dm_init_edca_turbo(hw);
         rtl92d_dm_init_rate_adaptive_mask(hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/dm.h b/drivers/net/wireless/rtlwifi/rtl8192de/dm.h
index 3fea0c11c24a..f2d318ceeb28 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/dm.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/dm.h
@@ -42,25 +42,12 @@
 #define BW_AUTO_SWITCH_HIGH_LOW                 25
 #define BW_AUTO_SWITCH_LOW_HIGH                 30
 
-#define DM_DIG_THRESH_HIGH                      40
-#define DM_DIG_THRESH_LOW                       35
-
-#define DM_FALSEALARM_THRESH_LOW                400
-#define DM_FALSEALARM_THRESH_HIGH               1000
-
-#define DM_DIG_MAX                              0x3e
-#define DM_DIG_MIN                              0x1c
-
 #define DM_DIG_FA_UPPER                         0x32
 #define DM_DIG_FA_LOWER                         0x20
 #define DM_DIG_FA_TH0                           0x100
 #define DM_DIG_FA_TH1                           0x400
 #define DM_DIG_FA_TH2                           0x600
 
-#define DM_DIG_BACKOFF_MAX                      12
-#define DM_DIG_BACKOFF_MIN                      -4
-#define DM_DIG_BACKOFF_DEFAULT                  10
-
 #define RXPATHSELECTION_SS_TH_lOW               30
 #define RXPATHSELECTION_DIFF_TH                 18
 
@@ -108,14 +95,6 @@ enum tag_dynamic_init_gain_operation_type_definition {
         DIG_OP_TYPE_MAX
 };
 
-enum tag_cck_packet_detection_threshold_type_definition {
-        CCK_PD_STAGE_LOWRSSI = 0,
-        CCK_PD_STAGE_HIGHRSSI = 1,
-        CCK_FA_STAGE_LOW = 2,
-        CCK_FA_STAGE_HIGH = 3,
-        CCK_PD_STAGE_MAX = 4,
-};
-
 enum dm_1r_cca {
         CCA_1R = 0,
         CCA_2R = 1,
@@ -134,23 +113,6 @@ enum dm_sw_ant_switch {
         ANS_ANTENNA_MAX = 3,
 };
 
-enum dm_dig_ext_port_alg {
-        DIG_EXT_PORT_STAGE_0 = 0,
-        DIG_EXT_PORT_STAGE_1 = 1,
-        DIG_EXT_PORT_STAGE_2 = 2,
-        DIG_EXT_PORT_STAGE_3 = 3,
-        DIG_EXT_PORT_STAGE_MAX = 4,
-};
-
-enum dm_dig_connect {
-        DIG_STA_DISCONNECT = 0,
-        DIG_STA_CONNECT = 1,
-        DIG_STA_BEFORE_CONNECT = 2,
-        DIG_MULTISTA_DISCONNECT = 3,
-        DIG_MULTISTA_CONNECT = 4,
-        DIG_CONNECT_MAX
-};
-
 void rtl92d_dm_init(struct ieee80211_hw *hw);
 void rtl92d_dm_watchdog(struct ieee80211_hw *hw);
 void rtl92d_dm_init_edca_turbo(struct ieee80211_hw *hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/fw.c b/drivers/net/wireless/rtlwifi/rtl8192de/fw.c
index 23177076b97f..62ef8209718f 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/fw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/fw.c
@@ -540,23 +540,6 @@ void rtl92d_fill_h2c_cmd(struct ieee80211_hw *hw,
         return;
 }
 
-void rtl92d_set_fw_pwrmode_cmd(struct ieee80211_hw *hw, u8 mode)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        u8 u1_h2c_set_pwrmode[3] = { 0 };
-        struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
-
-        RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, "FW LPS mode = %d\n", mode);
-        SET_H2CCMD_PWRMODE_PARM_MODE(u1_h2c_set_pwrmode, mode);
-        SET_H2CCMD_PWRMODE_PARM_SMART_PS(u1_h2c_set_pwrmode, 1);
-        SET_H2CCMD_PWRMODE_PARM_BCN_PASS_TIME(u1_h2c_set_pwrmode,
-                                              ppsc->reg_max_lps_awakeintvl);
-        RT_PRINT_DATA(rtlpriv, COMP_CMD, DBG_DMESG,
-                      "rtl92d_set_fw_rsvdpagepkt(): u1_h2c_set_pwrmode",
-                      u1_h2c_set_pwrmode, 3);
-        rtl92d_fill_h2c_cmd(hw, H2C_SETPWRMODE, 3, u1_h2c_set_pwrmode);
-}
-
 static bool _rtl92d_cmd_send_packet(struct ieee80211_hw *hw,
                                     struct sk_buff *skb)
 {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/fw.h b/drivers/net/wireless/rtlwifi/rtl8192de/fw.h
index a55a803a0b4d..1646e7c3d0f8 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/fw.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/fw.h
@@ -136,7 +136,6 @@ int rtl92d_download_fw(struct ieee80211_hw *hw);
 void rtl92d_fill_h2c_cmd(struct ieee80211_hw *hw, u8 element_id,
                          u32 cmd_len, u8 *p_cmdbuffer);
 void rtl92d_firmware_selfreset(struct ieee80211_hw *hw);
-void rtl92d_set_fw_pwrmode_cmd(struct ieee80211_hw *hw, u8 mode);
 void rtl92d_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished);
 void rtl92d_set_fw_joinbss_report_cmd(struct ieee80211_hw *hw, u8 mstatus);
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/hw.c b/drivers/net/wireless/rtlwifi/rtl8192de/hw.c
index 280c3da42993..01bcc2d218dc 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/hw.c
@@ -546,7 +546,7 @@ static bool _rtl92de_llt_table_init(struct ieee80211_hw *hw)
                 txpktbuf_bndy = 246;
                 value8 = 0;
                 value32 = 0x80bf0d29;
-        } else if (rtlpriv->rtlhal.macphymode != SINGLEMAC_SINGLEPHY) {
+        } else {
                 maxPage = 127;
                 txpktbuf_bndy = 123;
                 value8 = 0;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/sw.c b/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
index a0aba088259a..b19d0398215f 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
@@ -337,21 +337,21 @@ static struct rtl_hal_cfg rtl92de_hal_cfg = {
         .maps[RTL_IMR_ROK] = IMR_ROK,
         .maps[RTL_IBSS_INT_MASKS] = (IMR_BCNINT | IMR_TBDOK | IMR_TBDER),
 
-        .maps[RTL_RC_CCK_RATE1M] = DESC92_RATE1M,
-        .maps[RTL_RC_CCK_RATE2M] = DESC92_RATE2M,
-        .maps[RTL_RC_CCK_RATE5_5M] = DESC92_RATE5_5M,
-        .maps[RTL_RC_CCK_RATE11M] = DESC92_RATE11M,
-        .maps[RTL_RC_OFDM_RATE6M] = DESC92_RATE6M,
-        .maps[RTL_RC_OFDM_RATE9M] = DESC92_RATE9M,
-        .maps[RTL_RC_OFDM_RATE12M] = DESC92_RATE12M,
-        .maps[RTL_RC_OFDM_RATE18M] = DESC92_RATE18M,
-        .maps[RTL_RC_OFDM_RATE24M] = DESC92_RATE24M,
-        .maps[RTL_RC_OFDM_RATE36M] = DESC92_RATE36M,
-        .maps[RTL_RC_OFDM_RATE48M] = DESC92_RATE48M,
-        .maps[RTL_RC_OFDM_RATE54M] = DESC92_RATE54M,
-
-        .maps[RTL_RC_HT_RATEMCS7] = DESC92_RATEMCS7,
-        .maps[RTL_RC_HT_RATEMCS15] = DESC92_RATEMCS15,
+        .maps[RTL_RC_CCK_RATE1M] = DESC_RATE1M,
+        .maps[RTL_RC_CCK_RATE2M] = DESC_RATE2M,
+        .maps[RTL_RC_CCK_RATE5_5M] = DESC_RATE5_5M,
+        .maps[RTL_RC_CCK_RATE11M] = DESC_RATE11M,
+        .maps[RTL_RC_OFDM_RATE6M] = DESC_RATE6M,
+        .maps[RTL_RC_OFDM_RATE9M] = DESC_RATE9M,
+        .maps[RTL_RC_OFDM_RATE12M] = DESC_RATE12M,
+        .maps[RTL_RC_OFDM_RATE18M] = DESC_RATE18M,
+        .maps[RTL_RC_OFDM_RATE24M] = DESC_RATE24M,
+        .maps[RTL_RC_OFDM_RATE36M] = DESC_RATE36M,
+        .maps[RTL_RC_OFDM_RATE48M] = DESC_RATE48M,
+        .maps[RTL_RC_OFDM_RATE54M] = DESC_RATE54M,
+
+        .maps[RTL_RC_HT_RATEMCS7] = DESC_RATEMCS7,
+        .maps[RTL_RC_HT_RATEMCS15] = DESC_RATEMCS15,
 };
 
 static struct pci_device_id rtl92de_pci_ids[] = {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
index 8efbcc7af250..1feaa629dd4f 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
@@ -235,8 +235,8 @@ static void _rtl92de_query_rxphystatus(struct ieee80211_hw *hw,
                 pstats->rx_pwdb_all = pwdb_all;
                 pstats->rxpower = rx_pwr_all;
                 pstats->recvsignalpower = rx_pwr_all;
-                if (pdesc->rxht && pdesc->rxmcs >= DESC92_RATEMCS8 &&
-                    pdesc->rxmcs <= DESC92_RATEMCS15)
+                if (pdesc->rxht && pdesc->rxmcs >= DESC_RATEMCS8 &&
+                    pdesc->rxmcs <= DESC_RATEMCS15)
                         max_spatial_stream = 2;
                 else
                         max_spatial_stream = 1;
@@ -499,6 +499,7 @@ bool rtl92de_rx_query_desc(struct ieee80211_hw *hw,	struct rtl_stats *stats,
                                          && (GET_RX_DESC_FAGGR(pdesc) == 1));
         stats->timestamp_low = GET_RX_DESC_TSFL(pdesc);
         stats->rx_is40Mhzpacket = (bool) GET_RX_DESC_BW(pdesc);
+        stats->is_ht = (bool)GET_RX_DESC_RXHT(pdesc);
         rx_status->freq = hw->conf.chandef.chan->center_freq;
         rx_status->band = hw->conf.chandef.chan->band;
         if (GET_RX_DESC_CRC32(pdesc))
@@ -512,10 +513,8 @@ bool rtl92de_rx_query_desc(struct ieee80211_hw *hw,	struct rtl_stats *stats,
         rx_status->flag |= RX_FLAG_MACTIME_START;
         if (stats->decrypted)
                 rx_status->flag |= RX_FLAG_DECRYPTED;
-        rx_status->rate_idx = rtlwifi_rate_mapping(hw,
-                                        (bool)GET_RX_DESC_RXHT(pdesc),
-                                        (u8)GET_RX_DESC_RXMCS(pdesc),
-                                        (bool)GET_RX_DESC_PAGGR(pdesc));
+        rx_status->rate_idx = rtlwifi_rate_mapping(hw, stats->is_ht,
+                                                   false, stats->rate);
         rx_status->mactime = GET_RX_DESC_TSFL(pdesc);
         if (phystatus) {
                 p_drvinfo = (struct rx_fwinfo_92d *)(skb->data +
@@ -612,14 +611,14 @@ void rtl92de_tx_fill_desc(struct ieee80211_hw *hw,
                 }
                 /* 5G have no CCK rate */
                 if (rtlhal->current_bandtype == BAND_ON_5G)
-                        if (ptcb_desc->hw_rate < DESC92_RATE6M)
-                                ptcb_desc->hw_rate = DESC92_RATE6M;
+                        if (ptcb_desc->hw_rate < DESC_RATE6M)
+                                ptcb_desc->hw_rate = DESC_RATE6M;
                 SET_TX_DESC_TX_RATE(pdesc, ptcb_desc->hw_rate);
                 if (ptcb_desc->use_shortgi || ptcb_desc->use_shortpreamble)
                         SET_TX_DESC_DATA_SHORTGI(pdesc, 1);
 
                 if (rtlhal->macphymode == DUALMAC_DUALPHY &&
-                        ptcb_desc->hw_rate == DESC92_RATEMCS7)
+                        ptcb_desc->hw_rate == DESC_RATEMCS7)
                         SET_TX_DESC_DATA_SHORTGI(pdesc, 1);
 
                 if (info->flags & IEEE80211_TX_CTL_AMPDU) {
@@ -635,13 +634,13 @@ void rtl92de_tx_fill_desc(struct ieee80211_hw *hw,
                 SET_TX_DESC_RTS_STBC(pdesc, ((ptcb_desc->rts_stbc) ? 1 : 0));
                 /* 5G have no CCK rate */
                 if (rtlhal->current_bandtype == BAND_ON_5G)
-                        if (ptcb_desc->rts_rate < DESC92_RATE6M)
-                                ptcb_desc->rts_rate = DESC92_RATE6M;
+                        if (ptcb_desc->rts_rate < DESC_RATE6M)
+                                ptcb_desc->rts_rate = DESC_RATE6M;
                 SET_TX_DESC_RTS_RATE(pdesc, ptcb_desc->rts_rate);
                 SET_TX_DESC_RTS_BW(pdesc, 0);
                 SET_TX_DESC_RTS_SC(pdesc, ptcb_desc->rts_sc);
                 SET_TX_DESC_RTS_SHORT(pdesc, ((ptcb_desc->rts_rate <=
-                        DESC92_RATE54M) ?
+                        DESC_RATE54M) ?
                         (ptcb_desc->rts_use_shortpreamble ? 1 : 0) :
                         (ptcb_desc->rts_use_shortgi ? 1 : 0)));
                 if (bw_40) {
@@ -756,9 +755,9 @@ void rtl92de_tx_fill_cmddesc(struct ieee80211_hw *hw,
          * The braces are needed no matter what checkpatch says
          */
         if (rtlhal->current_bandtype == BAND_ON_5G) {
-                SET_TX_DESC_TX_RATE(pdesc, DESC92_RATE6M);
+                SET_TX_DESC_TX_RATE(pdesc, DESC_RATE6M);
         } else {
-                SET_TX_DESC_TX_RATE(pdesc, DESC92_RATE1M);
+                SET_TX_DESC_TX_RATE(pdesc, DESC_RATE1M);
         }
         SET_TX_DESC_SEQ(pdesc, 0);
         SET_TX_DESC_LINIP(pdesc, 0);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/dm.c b/drivers/net/wireless/rtlwifi/rtl8192ee/dm.c
index 77deedf79d1d..459f3d0efa2f 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ee/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ee/dm.c
@@ -26,6 +26,7 @@
 #include "../wifi.h"
 #include "../base.h"
 #include "../pci.h"
+#include "../core.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -151,35 +152,6 @@ static const u8 cckswing_table_ch14[CCK_TABLE_SIZE][8] = {
         {0x09, 0x08, 0x07, 0x04, 0x00, 0x00, 0x00, 0x00}  /* 32, -16.0dB */
 };
 
-static void rtl92ee_dm_diginit(struct ieee80211_hw *hw)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct dig_t *dm_dig = &rtlpriv->dm_digtable;
-
-        dm_dig->cur_igvalue = rtl_get_bbreg(hw, DM_REG_IGI_A_11N,
-                                            DM_BIT_IGI_11N);
-        dm_dig->rssi_lowthresh = DM_DIG_THRESH_LOW;
-        dm_dig->rssi_highthresh = DM_DIG_THRESH_HIGH;
-        dm_dig->fa_lowthresh = DM_FALSEALARM_THRESH_LOW;
-        dm_dig->fa_highthresh = DM_FALSEALARM_THRESH_HIGH;
-        dm_dig->rx_gain_max = DM_DIG_MAX;
-        dm_dig->rx_gain_min = DM_DIG_MIN;
-        dm_dig->back_val = DM_DIG_BACKOFF_DEFAULT;
-        dm_dig->back_range_max = DM_DIG_BACKOFF_MAX;
-        dm_dig->back_range_min = DM_DIG_BACKOFF_MIN;
-        dm_dig->pre_cck_cca_thres = 0xff;
-        dm_dig->cur_cck_cca_thres = 0x83;
-        dm_dig->forbidden_igi = DM_DIG_MIN;
-        dm_dig->large_fa_hit = 0;
-        dm_dig->recover_cnt = 0;
-        dm_dig->dig_dynamic_min = DM_DIG_MIN;
-        dm_dig->dig_dynamic_min_1 = DM_DIG_MIN;
-        dm_dig->media_connect_0 = false;
-        dm_dig->media_connect_1 = false;
-        rtlpriv->dm.dm_initialgain_enable = true;
-        dm_dig->bt30_cur_igi = 0x32;
-}
-
 static void rtl92ee_dm_false_alarm_counter_statistics(struct ieee80211_hw *hw)
 {
         u32 ret_value;
@@ -298,7 +270,7 @@ static void rtl92ee_dm_dig(struct ieee80211_hw *hw)
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
         struct dig_t *dm_dig = &rtlpriv->dm_digtable;
-        u8 dig_dynamic_min , dig_maxofmin;
+        u8 dig_min_0, dig_maxofmin;
         bool bfirstconnect , bfirstdisconnect;
         u8 dm_dig_max, dm_dig_min;
         u8 current_igi = dm_dig->cur_igvalue;
@@ -308,7 +280,7 @@ static void rtl92ee_dm_dig(struct ieee80211_hw *hw)
         if (mac->act_scanning)
                 return;
 
-        dig_dynamic_min = dm_dig->dig_dynamic_min;
+        dig_min_0 = dm_dig->dig_min_0;
         bfirstconnect = (mac->link_state >= MAC80211_LINKED) &&
                         !dm_dig->media_connect_0;
         bfirstdisconnect = (mac->link_state < MAC80211_LINKED) &&
@@ -329,19 +301,19 @@ static void rtl92ee_dm_dig(struct ieee80211_hw *hw)
                 if (rtlpriv->dm.one_entry_only) {
                         offset = 0;
                         if (dm_dig->rssi_val_min - offset < dm_dig_min)
-                                dig_dynamic_min = dm_dig_min;
+                                dig_min_0 = dm_dig_min;
                         else if (dm_dig->rssi_val_min - offset >
                                  dig_maxofmin)
-                                dig_dynamic_min = dig_maxofmin;
+                                dig_min_0 = dig_maxofmin;
                         else
-                                dig_dynamic_min = dm_dig->rssi_val_min - offset;
+                                dig_min_0 = dm_dig->rssi_val_min - offset;
                 } else {
-                        dig_dynamic_min = dm_dig_min;
+                        dig_min_0 = dm_dig_min;
                 }
 
         } else {
                 dm_dig->rx_gain_max = dm_dig_max;
-                dig_dynamic_min = dm_dig_min;
+                dig_min_0 = dm_dig_min;
                 RT_TRACE(rtlpriv, COMP_DIG, DBG_LOUD, "no link\n");
         }
 
@@ -368,10 +340,10 @@ static void rtl92ee_dm_dig(struct ieee80211_hw *hw)
                 } else {
                         if (dm_dig->large_fa_hit < 3) {
                                 if ((dm_dig->forbidden_igi - 1) <
-                                    dig_dynamic_min) {
-                                        dm_dig->forbidden_igi = dig_dynamic_min;
+                                    dig_min_0) {
+                                        dm_dig->forbidden_igi = dig_min_0;
                                         dm_dig->rx_gain_min =
-                                                                dig_dynamic_min;
+                                                                dig_min_0;
                                 } else {
                                         dm_dig->forbidden_igi--;
                                         dm_dig->rx_gain_min =
@@ -430,7 +402,7 @@ static void rtl92ee_dm_dig(struct ieee80211_hw *hw)
         rtl92ee_dm_write_dig(hw , current_igi);
         dm_dig->media_connect_0 = ((mac->link_state >= MAC80211_LINKED) ?
                                    true : false);
-        dm_dig->dig_dynamic_min = dig_dynamic_min;
+        dm_dig->dig_min_0 = dig_min_0;
 }
 
 void rtl92ee_dm_write_cck_cca_thres(struct ieee80211_hw *hw, u8 cur_thres)
@@ -1088,10 +1060,11 @@ static void rtl92ee_dm_init_dynamic_atc_switch(struct ieee80211_hw *hw)
 void rtl92ee_dm_init(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u32 cur_igvalue = rtl_get_bbreg(hw, DM_REG_IGI_A_11N, DM_BIT_IGI_11N);
 
         rtlpriv->dm.dm_type = DM_TYPE_BYDRIVER;
 
-        rtl92ee_dm_diginit(hw);
+        rtl_dm_diginit(hw, cur_igvalue);
         rtl92ee_dm_init_rate_adaptive_mask(hw);
         rtl92ee_dm_init_primary_cca_check(hw);
         rtl92ee_dm_init_edca_turbo(hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/dm.h b/drivers/net/wireless/rtlwifi/rtl8192ee/dm.h
index 881db7d6fef7..107d5a488fa8 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ee/dm.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ee/dm.h
@@ -189,28 +189,12 @@
 #define BW_AUTO_SWITCH_HIGH_LOW                 25
 #define BW_AUTO_SWITCH_LOW_HIGH                 30
 
-#define DM_DIG_THRESH_HIGH                      40
-#define DM_DIG_THRESH_LOW                       35
-
-#define DM_FALSEALARM_THRESH_LOW                400
-#define DM_FALSEALARM_THRESH_HIGH               1000
-
-#define DM_DIG_MAX                              0x3e
-#define DM_DIG_MIN                              0x1e
-
-#define DM_DIG_MAX_AP                           0x32
-#define DM_DIG_MIN_AP                           0x20
-
 #define DM_DIG_FA_UPPER                         0x3e
 #define DM_DIG_FA_LOWER                         0x1e
 #define DM_DIG_FA_TH0                           0x200
 #define DM_DIG_FA_TH1                           0x300
 #define DM_DIG_FA_TH2                           0x400
 
-#define DM_DIG_BACKOFF_MAX                      12
-#define DM_DIG_BACKOFF_MIN                      -4
-#define DM_DIG_BACKOFF_DEFAULT                  10
-
 #define RXPATHSELECTION_SS_TH_LOW               30
 #define RXPATHSELECTION_DIFF_TH                 18
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/fw.c b/drivers/net/wireless/rtlwifi/rtl8192ee/fw.c
index 45c128b91f7f..c5d4b8013cde 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ee/fw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ee/fw.c
@@ -666,7 +666,6 @@ void rtl92ee_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
         struct sk_buff *skb = NULL;
 
         u32 totalpacketlen;
-        bool rtstatus;
         u8 u1rsvdpageloc[5] = { 0 };
         bool b_dlok = false;
 
@@ -728,10 +727,7 @@ void rtl92ee_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
         memcpy((u8 *)skb_put(skb, totalpacketlen),
                &reserved_page_packet, totalpacketlen);
 
-        rtstatus = rtl_cmd_send_packet(hw, skb);
-
-        if (rtstatus)
-                b_dlok = true;
+        b_dlok = true;
 
         if (b_dlok) {
                 RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD ,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
index 1a87edca2c3f..b461b3128da5 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
@@ -85,29 +85,6 @@ static void _rtl92ee_enable_bcn_sub_func(struct ieee80211_hw *hw)
         _rtl92ee_set_bcn_ctrl_reg(hw, 0, BIT(1));
 }
 
-static void _rtl92ee_return_beacon_queue_skb(struct ieee80211_hw *hw)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
-        struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[BEACON_QUEUE];
-        unsigned long flags;
-
-        spin_lock_irqsave(&rtlpriv->locks.irq_th_lock, flags);
-        while (skb_queue_len(&ring->queue)) {
-                struct rtl_tx_buffer_desc *entry =
-                                                &ring->buffer_desc[ring->idx];
-                struct sk_buff *skb = __skb_dequeue(&ring->queue);
-
-                pci_unmap_single(rtlpci->pdev,
-                                 rtlpriv->cfg->ops->get_desc(
-                                 (u8 *)entry, true, HW_DESC_TXBUFF_ADDR),
-                                 skb->len, PCI_DMA_TODEVICE);
-                kfree_skb(skb);
-                ring->idx = (ring->idx + 1) % ring->entries;
-        }
-        spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags);
-}
-
 static void _rtl92ee_disable_bcn_sub_func(struct ieee80211_hw *hw)
 {
         _rtl92ee_set_bcn_ctrl_reg(hw, BIT(1), 0);
@@ -403,9 +380,6 @@ static void _rtl92ee_download_rsvd_page(struct ieee80211_hw *hw)
                 rtl_write_byte(rtlpriv, REG_DWBCN0_CTRL + 2,
                                bcnvalid_reg | BIT(0));
 
-                /* Return Beacon TCB */
-                _rtl92ee_return_beacon_queue_skb(hw);
-
                 /* download rsvd page */
                 rtl92ee_set_fw_rsvdpagepkt(hw, false);
 
@@ -1163,6 +1137,139 @@ void rtl92ee_enable_hw_security_config(struct ieee80211_hw *hw)
         rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_WPA_CONFIG, &sec_reg_value);
 }
 
+static bool _rtl8192ee_check_pcie_dma_hang(struct rtl_priv *rtlpriv)
+{
+        u8 tmp;
+
+        /* write reg 0x350 Bit[26]=1. Enable debug port. */
+        tmp = rtl_read_byte(rtlpriv, REG_BACKDOOR_DBI_DATA + 3);
+        if (!(tmp & BIT(2))) {
+                rtl_write_byte(rtlpriv, REG_BACKDOOR_DBI_DATA + 3,
+                               tmp | BIT(2));
+                mdelay(100); /* Suggested by DD Justin_tsai. */
+        }
+
+        /* read reg 0x350 Bit[25] if 1 : RX hang
+         * read reg 0x350 Bit[24] if 1 : TX hang
+         */
+        tmp = rtl_read_byte(rtlpriv, REG_BACKDOOR_DBI_DATA + 3);
+        if ((tmp & BIT(0)) || (tmp & BIT(1))) {
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                         "CheckPcieDMAHang8192EE(): true!!\n");
+                return true;
+        }
+        return false;
+}
+
+static void _rtl8192ee_reset_pcie_interface_dma(struct rtl_priv *rtlpriv,
+                                                bool mac_power_on)
+{
+        u8 tmp;
+        bool release_mac_rx_pause;
+        u8 backup_pcie_dma_pause;
+
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                 "ResetPcieInterfaceDMA8192EE()\n");
+
+        /* Revise Note: Follow the document "PCIe RX DMA Hang Reset Flow_v03"
+         * released by SD1 Alan.
+         */
+
+        /* 1. disable register write lock
+         *      write 0x1C bit[1:0] = 2'h0
+         *      write 0xCC bit[2] = 1'b1
+         */
+        tmp = rtl_read_byte(rtlpriv, REG_RSV_CTRL);
+        tmp &= ~(BIT(1) | BIT(0));
+        rtl_write_byte(rtlpriv, REG_RSV_CTRL, tmp);
+        tmp = rtl_read_byte(rtlpriv, REG_PMC_DBG_CTRL2);
+        tmp |= BIT(2);
+        rtl_write_byte(rtlpriv, REG_PMC_DBG_CTRL2, tmp);
+
+        /* 2. Check and pause TRX DMA
+         *      write 0x284 bit[18] = 1'b1
+         *      write 0x301 = 0xFF
+         */
+        tmp = rtl_read_byte(rtlpriv, REG_RXDMA_CONTROL);
+        if (tmp & BIT(2)) {
+                /* Already pause before the function for another reason. */
+                release_mac_rx_pause = false;
+        } else {
+                rtl_write_byte(rtlpriv, REG_RXDMA_CONTROL, (tmp | BIT(2)));
+                release_mac_rx_pause = true;
+        }
+
+        backup_pcie_dma_pause = rtl_read_byte(rtlpriv, REG_PCIE_CTRL_REG + 1);
+        if (backup_pcie_dma_pause != 0xFF)
+                rtl_write_byte(rtlpriv, REG_PCIE_CTRL_REG + 1, 0xFF);
+
+        if (mac_power_on) {
+                /* 3. reset TRX function
+                 *      write 0x100 = 0x00
+                 */
+                rtl_write_byte(rtlpriv, REG_CR, 0);
+        }
+
+        /* 4. Reset PCIe DMA
+         *      write 0x003 bit[0] = 0
+         */
+        tmp = rtl_read_byte(rtlpriv, REG_SYS_FUNC_EN + 1);
+        tmp &= ~(BIT(0));
+        rtl_write_byte(rtlpriv, REG_SYS_FUNC_EN + 1, tmp);
+
+        /* 5. Enable PCIe DMA
+         *      write 0x003 bit[0] = 1
+         */
+        tmp = rtl_read_byte(rtlpriv, REG_SYS_FUNC_EN + 1);
+        tmp |= BIT(0);
+        rtl_write_byte(rtlpriv, REG_SYS_FUNC_EN + 1, tmp);
+
+        if (mac_power_on) {
+                /* 6. enable TRX function
+                 *      write 0x100 = 0xFF
+                 */
+                rtl_write_byte(rtlpriv, REG_CR, 0xFF);
+
+                /* We should init LLT & RQPN and
+                 * prepare Tx/Rx descrptor address later
+                 * because MAC function is reset.
+                 */
+        }
+
+        /* 7. Restore PCIe autoload down bit
+         *      write 0xF8 bit[17] = 1'b1
+         */
+        tmp = rtl_read_byte(rtlpriv, REG_MAC_PHY_CTRL_NORMAL + 2);
+        tmp |= BIT(1);
+        rtl_write_byte(rtlpriv, REG_MAC_PHY_CTRL_NORMAL + 2, tmp);
+
+        /* In MAC power on state, BB and RF maybe in ON state,
+         * if we release TRx DMA here
+         * it will cause packets to be started to Tx/Rx,
+         * so we release Tx/Rx DMA later.
+         */
+        if (!mac_power_on) {
+                /* 8. release TRX DMA
+                 *      write 0x284 bit[18] = 1'b0
+                 *      write 0x301 = 0x00
+                 */
+                if (release_mac_rx_pause) {
+                        tmp = rtl_read_byte(rtlpriv, REG_RXDMA_CONTROL);
+                        rtl_write_byte(rtlpriv, REG_RXDMA_CONTROL,
+                                       (tmp & (~BIT(2))));
+                }
+                rtl_write_byte(rtlpriv, REG_PCIE_CTRL_REG + 1,
+                               backup_pcie_dma_pause);
+        }
+
+        /* 9. lock system register
+         *      write 0xCC bit[2] = 1'b0
+         */
+        tmp = rtl_read_byte(rtlpriv, REG_PMC_DBG_CTRL2);
+        tmp &= ~(BIT(2));
+        rtl_write_byte(rtlpriv, REG_PMC_DBG_CTRL2, tmp);
+}
+
 int rtl92ee_hw_init(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -1188,6 +1295,13 @@ int rtl92ee_hw_init(struct ieee80211_hw *hw)
                 rtlhal->fw_ps_state = FW_PS_STATE_ALL_ON_92E;
         }
 
+        if (_rtl8192ee_check_pcie_dma_hang(rtlpriv)) {
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "92ee dma hang!\n");
+                _rtl8192ee_reset_pcie_interface_dma(rtlpriv,
+                                                    rtlhal->mac_func_enable);
+                rtlhal->mac_func_enable = false;
+        }
+
         rtstatus = _rtl92ee_init_mac(hw);
 
         rtl_write_byte(rtlpriv, 0x577, 0x03);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/reg.h b/drivers/net/wireless/rtlwifi/rtl8192ee/reg.h
index 3f2a9596e7cd..1eaa1fab550d 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ee/reg.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ee/reg.h
@@ -77,9 +77,11 @@
 #define REG_HIMRE                               0x00B8
 #define REG_HISRE                               0x00BC
 
+#define REG_PMC_DBG_CTRL2                       0x00CC
 #define REG_EFUSE_ACCESS                        0x00CF
 #define REG_HPON_FSM                            0x00EC
 #define REG_SYS_CFG1                            0x00F0
+#define REG_MAC_PHY_CTRL_NORMAL                 0x00F8
 #define REG_SYS_CFG2                            0x00FC
 
 #define REG_CR                                  0x0100
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/sw.c b/drivers/net/wireless/rtlwifi/rtl8192ee/sw.c
index 9b5a7d5be121..c31c6bfb536d 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ee/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ee/sw.c
@@ -113,8 +113,6 @@ int rtl92ee_init_sw_vars(struct ieee80211_hw *hw)
                                   RCR_HTC_LOC_CTRL              |
                                   RCR_AMF                       |
                                   RCR_ACF                       |
-                                  RCR_ADF                       |
-                                  RCR_AICV                      |
                                   RCR_ACRC32                    |
                                   RCR_AB                        |
                                   RCR_AM                        |
@@ -241,6 +239,7 @@ static struct rtl_hal_ops rtl8192ee_hal_ops = {
         .set_desc = rtl92ee_set_desc,
         .get_desc = rtl92ee_get_desc,
         .is_tx_desc_closed = rtl92ee_is_tx_desc_closed,
+        .get_available_desc = rtl92ee_get_available_desc,
         .tx_polling = rtl92ee_tx_polling,
         .enable_hw_sec = rtl92ee_enable_hw_security_config,
         .set_key = rtl92ee_set_key,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
index 2fcbef1d029f..d39ee67f6113 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
@@ -47,164 +47,6 @@ static u8 _rtl92ee_map_hwqueue_to_fwqueue(struct sk_buff *skb, u8 hw_queue)
         return skb->priority;
 }
 
-/* mac80211's rate_idx is like this:
- *
- * 2.4G band:rx_status->band == IEEE80211_BAND_2GHZ
- *
- * B/G rate:
- * (rx_status->flag & RX_FLAG_HT) = 0,
- * DESC92C_RATE1M-->DESC92C_RATE54M ==> idx is 0-->11,
- *
- * N rate:
- * (rx_status->flag & RX_FLAG_HT) = 1,
- * DESC92C_RATEMCS0-->DESC92C_RATEMCS15 ==> idx is 0-->15
- *
- * 5G band:rx_status->band == IEEE80211_BAND_5GHZ
- * A rate:
- * (rx_status->flag & RX_FLAG_HT) = 0,
- * DESC92C_RATE6M-->DESC92C_RATE54M ==> idx is 0-->7,
- *
- * N rate:
- * (rx_status->flag & RX_FLAG_HT) = 1,
- * DESC92C_RATEMCS0-->DESC92C_RATEMCS15 ==> idx is 0-->15
- */
-static int _rtl92ee_rate_mapping(struct ieee80211_hw *hw,
-                                 bool isht, u8 desc_rate)
-{
-        int rate_idx;
-
-        if (!isht) {
-                if (IEEE80211_BAND_2GHZ == hw->conf.chandef.chan->band) {
-                        switch (desc_rate) {
-                        case DESC92C_RATE1M:
-                                rate_idx = 0;
-                                break;
-                        case DESC92C_RATE2M:
-                                rate_idx = 1;
-                                break;
-                        case DESC92C_RATE5_5M:
-                                rate_idx = 2;
-                                break;
-                        case DESC92C_RATE11M:
-                                rate_idx = 3;
-                                break;
-                        case DESC92C_RATE6M:
-                                rate_idx = 4;
-                                break;
-                        case DESC92C_RATE9M:
-                                rate_idx = 5;
-                                break;
-                        case DESC92C_RATE12M:
-                                rate_idx = 6;
-                                break;
-                        case DESC92C_RATE18M:
-                                rate_idx = 7;
-                                break;
-                        case DESC92C_RATE24M:
-                                rate_idx = 8;
-                                break;
-                        case DESC92C_RATE36M:
-                                rate_idx = 9;
-                                break;
-                        case DESC92C_RATE48M:
-                                rate_idx = 10;
-                                break;
-                        case DESC92C_RATE54M:
-                                rate_idx = 11;
-                                break;
-                        default:
-                                rate_idx = 0;
-                                break;
-                        }
-                } else {
-                        switch (desc_rate) {
-                        case DESC92C_RATE6M:
-                                rate_idx = 0;
-                                break;
-                        case DESC92C_RATE9M:
-                                rate_idx = 1;
-                                break;
-                        case DESC92C_RATE12M:
-                                rate_idx = 2;
-                                break;
-                        case DESC92C_RATE18M:
-                                rate_idx = 3;
-                                break;
-                        case DESC92C_RATE24M:
-                                rate_idx = 4;
-                                break;
-                        case DESC92C_RATE36M:
-                                rate_idx = 5;
-                                break;
-                        case DESC92C_RATE48M:
-                                rate_idx = 6;
-                                break;
-                        case DESC92C_RATE54M:
-                                rate_idx = 7;
-                                break;
-                        default:
-                                rate_idx = 0;
-                                break;
-                        }
-                }
-        } else {
-                switch (desc_rate) {
-                case DESC92C_RATEMCS0:
-                        rate_idx = 0;
-                        break;
-                case DESC92C_RATEMCS1:
-                        rate_idx = 1;
-                        break;
-                case DESC92C_RATEMCS2:
-                        rate_idx = 2;
-                        break;
-                case DESC92C_RATEMCS3:
-                        rate_idx = 3;
-                        break;
-                case DESC92C_RATEMCS4:
-                        rate_idx = 4;
-                        break;
-                case DESC92C_RATEMCS5:
-                        rate_idx = 5;
-                        break;
-                case DESC92C_RATEMCS6:
-                        rate_idx = 6;
-                        break;
-                case DESC92C_RATEMCS7:
-                        rate_idx = 7;
-                        break;
-                case DESC92C_RATEMCS8:
-                        rate_idx = 8;
-                        break;
-                case DESC92C_RATEMCS9:
-                        rate_idx = 9;
-                        break;
-                case DESC92C_RATEMCS10:
-                        rate_idx = 10;
-                        break;
-                case DESC92C_RATEMCS11:
-                        rate_idx = 11;
-                        break;
-                case DESC92C_RATEMCS12:
-                        rate_idx = 12;
-                        break;
-                case DESC92C_RATEMCS13:
-                        rate_idx = 13;
-                        break;
-                case DESC92C_RATEMCS14:
-                        rate_idx = 14;
-                        break;
-                case DESC92C_RATEMCS15:
-                        rate_idx = 15;
-                        break;
-                default:
-                        rate_idx = 0;
-                        break;
-                }
-        }
-        return rate_idx;
-}
-
 static void _rtl92ee_query_rxphystatus(struct ieee80211_hw *hw,
                                        struct rtl_stats *pstatus, u8 *pdesc,
                                        struct rx_fwinfo *p_drvinfo,
@@ -345,8 +187,8 @@ static void _rtl92ee_query_rxphystatus(struct ieee80211_hw *hw,
                 pstatus->recvsignalpower = rx_pwr_all;
 
                 /* (3)EVM of HT rate */
-                if (pstatus->rate >= DESC92C_RATEMCS8 &&
-                    pstatus->rate <= DESC92C_RATEMCS15)
+                if (pstatus->rate >= DESC_RATEMCS8 &&
+                    pstatus->rate <= DESC_RATEMCS15)
                         max_spatial_stream = 2;
                 else
                         max_spatial_stream = 1;
@@ -512,6 +354,10 @@ bool rtl92ee_rx_query_desc(struct ieee80211_hw *hw,
         struct ieee80211_hdr *hdr;
         u32 phystatus = GET_RX_DESC_PHYST(pdesc);
 
+        if (GET_RX_STATUS_DESC_RPT_SEL(pdesc) == 0)
+                status->packet_report_type = NORMAL_RX;
+        else
+                status->packet_report_type = C2H_PACKET;
         status->length = (u16)GET_RX_DESC_PKT_LEN(pdesc);
         status->rx_drvinfo_size = (u8)GET_RX_DESC_DRV_INFO_SIZE(pdesc) *
                                   RX_DRV_INFO_SIZE_UNIT;
@@ -576,9 +422,8 @@ bool rtl92ee_rx_query_desc(struct ieee80211_hw *hw,
          * are use (RX_FLAG_HT)
          * Notice: this is diff with windows define
          */
-        rx_status->rate_idx = _rtl92ee_rate_mapping(hw,
-                                                    status->is_ht,
-                                                    status->rate);
+        rx_status->rate_idx = rtlwifi_rate_mapping(hw, status->is_ht,
+                                                   false, status->rate);
 
         rx_status->mactime = status->timestamp_low;
         if (phystatus) {
@@ -654,14 +499,7 @@ u16 rtl92ee_rx_desc_buff_remained_cnt(struct ieee80211_hw *hw, u8 queue_index)
         if (!start_rx)
                 return 0;
 
-        if ((last_read_point > (RX_DESC_NUM_92E / 2)) &&
-            (read_point <= (RX_DESC_NUM_92E / 2))) {
-                remind_cnt = RX_DESC_NUM_92E - write_point;
-        } else {
-                remind_cnt = (read_point >= write_point) ?
-                             (read_point - write_point) :
-                             (RX_DESC_NUM_92E - write_point + read_point);
-        }
+        remind_cnt = calc_fifo_space(read_point, write_point);
 
         if (remind_cnt == 0)
                 return 0;
@@ -710,7 +548,7 @@ static u16 get_desc_addr_fr_q_idx(u16 queue_index)
         return desc_address;
 }
 
-void rtl92ee_get_available_desc(struct ieee80211_hw *hw, u8 q_idx)
+u16 rtl92ee_get_available_desc(struct ieee80211_hw *hw, u8 q_idx)
 {
         struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -723,12 +561,11 @@ void rtl92ee_get_available_desc(struct ieee80211_hw *hw, u8 q_idx)
         current_tx_read_point = (u16)((tmp_4byte >> 16) & 0x0fff);
         current_tx_write_point = (u16)((tmp_4byte) & 0x0fff);
 
-        point_diff = ((current_tx_read_point > current_tx_write_point) ?
-                      (current_tx_read_point - current_tx_write_point) :
-                      (TX_DESC_NUM_92E - current_tx_write_point +
-                       current_tx_read_point));
+        point_diff = calc_fifo_space(current_tx_read_point,
+                                     current_tx_write_point);
 
         rtlpci->tx_ring[q_idx].avl_desc = point_diff;
+        return point_diff;
 }
 
 void rtl92ee_pre_fill_tx_bd_desc(struct ieee80211_hw *hw,
@@ -901,13 +738,13 @@ void rtl92ee_tx_fill_desc(struct ieee80211_hw *hw,
                 } else {
                         if (rtlpriv->ra.is_special_data) {
                                 ptcb_desc->use_driver_rate = true;
-                                SET_TX_DESC_TX_RATE(pdesc, DESC92C_RATE11M);
+                                SET_TX_DESC_TX_RATE(pdesc, DESC_RATE11M);
                         } else {
                                 ptcb_desc->use_driver_rate = false;
                         }
                 }
 
-                if (ptcb_desc->hw_rate > DESC92C_RATEMCS0)
+                if (ptcb_desc->hw_rate > DESC_RATEMCS0)
                         short_gi = (ptcb_desc->use_shortgi) ? 1 : 0;
                 else
                         short_gi = (ptcb_desc->use_shortpreamble) ? 1 : 0;
@@ -927,7 +764,7 @@ void rtl92ee_tx_fill_desc(struct ieee80211_hw *hw,
                 SET_TX_DESC_RTS_RATE(pdesc, ptcb_desc->rts_rate);
                 SET_TX_DESC_RTS_SC(pdesc, ptcb_desc->rts_sc);
                 SET_TX_DESC_RTS_SHORT(pdesc,
-                                ((ptcb_desc->rts_rate <= DESC92C_RATE54M) ?
+                                ((ptcb_desc->rts_rate <= DESC_RATE54M) ?
                                  (ptcb_desc->rts_use_shortpreamble ? 1 : 0) :
                                  (ptcb_desc->rts_use_shortgi ? 1 : 0)));
 
@@ -1038,7 +875,7 @@ void rtl92ee_tx_fill_cmddesc(struct ieee80211_hw *hw,
         if (firstseg)
                 SET_TX_DESC_OFFSET(pdesc, txdesc_len);
 
-        SET_TX_DESC_TX_RATE(pdesc, DESC92C_RATE1M);
+        SET_TX_DESC_TX_RATE(pdesc, DESC_RATE1M);
 
         SET_TX_DESC_SEQ(pdesc, 0);
 
@@ -1207,8 +1044,7 @@ bool rtl92ee_is_tx_desc_closed(struct ieee80211_hw *hw, u8 hw_queue, u16 index)
         static u8 stop_report_cnt;
         struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[hw_queue];
 
-        /*checking Read/Write Point each interrupt wastes CPU */
-        if (stop_report_cnt > 15 || !rtlpriv->link_info.busytraffic) {
+        {
                 u16 point_diff = 0;
                 u16 cur_tx_rp, cur_tx_wp;
                 u32 tmpu32 = 0;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.h b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.h
index 6f9be1c7515c..8f78ac9e6040 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.h
@@ -542,6 +542,8 @@
         LE_BITS_TO_4BYTE(__pdesc+8, 12, 4)
 #define GET_RX_DESC_RX_IS_QOS(__pdesc)                  \
         LE_BITS_TO_4BYTE(__pdesc+8, 16, 1)
+#define GET_RX_STATUS_DESC_RPT_SEL(__pdesc)             \
+        LE_BITS_TO_4BYTE(__pdesc+8, 28, 1)
 
 #define GET_RX_DESC_RXMCS(__pdesc)                      \
         LE_BITS_TO_4BYTE(__pdesc+12, 0, 7)
@@ -591,10 +593,10 @@ do {								\
 } while (0)
 
 #define RTL92EE_RX_HAL_IS_CCK_RATE(rxmcs)\
-        (rxmcs == DESC92C_RATE1M ||\
-         rxmcs == DESC92C_RATE2M ||\
-         rxmcs == DESC92C_RATE5_5M ||\
-         rxmcs == DESC92C_RATE11M)
+        (rxmcs == DESC_RATE1M ||\
+         rxmcs == DESC_RATE2M ||\
+         rxmcs == DESC_RATE5_5M ||\
+         rxmcs == DESC_RATE11M)
 
 #define IS_LITTLE_ENDIAN        1
 
@@ -829,7 +831,7 @@ void rtl92ee_rx_check_dma_ok(struct ieee80211_hw *hw, u8 *header_desc,
                              u8 queue_index);
 u16     rtl92ee_rx_desc_buff_remained_cnt(struct ieee80211_hw *hw,
                                           u8 queue_index);
-void rtl92ee_get_available_desc(struct ieee80211_hw *hw, u8 queue_index);
+u16 rtl92ee_get_available_desc(struct ieee80211_hw *hw, u8 queue_index);
 void rtl92ee_pre_fill_tx_bd_desc(struct ieee80211_hw *hw,
                                  u8 *tx_bd_desc, u8 *desc, u8 queue_index,
                                  struct sk_buff *skb, dma_addr_t addr);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/def.h b/drivers/net/wireless/rtlwifi/rtl8192se/def.h
index 6e7a70b43949..ef87c09b77d0 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/def.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/def.h
@@ -450,10 +450,10 @@
         SHIFT_AND_MASK_LE(__pdesc + 24, 0, 32)
 
 #define SE_RX_HAL_IS_CCK_RATE(_pdesc)\
-        (GET_RX_STATUS_DESC_RX_MCS(_pdesc) == DESC92_RATE1M ||  \
-         GET_RX_STATUS_DESC_RX_MCS(_pdesc) == DESC92_RATE2M ||  \
-         GET_RX_STATUS_DESC_RX_MCS(_pdesc) == DESC92_RATE5_5M ||\
-         GET_RX_STATUS_DESC_RX_MCS(_pdesc) == DESC92_RATE11M)
+        (GET_RX_STATUS_DESC_RX_MCS(_pdesc) == DESC_RATE1M ||    \
+         GET_RX_STATUS_DESC_RX_MCS(_pdesc) == DESC_RATE2M ||    \
+         GET_RX_STATUS_DESC_RX_MCS(_pdesc) == DESC_RATE5_5M ||\
+         GET_RX_STATUS_DESC_RX_MCS(_pdesc) == DESC_RATE11M)
 
 enum rf_optype {
         RF_OP_BY_SW_3WIRE = 0,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/dm.c b/drivers/net/wireless/rtlwifi/rtl8192se/dm.c
index b3a2d5ec59e6..575980b88658 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/dm.c
@@ -29,6 +29,7 @@
 
 #include "../wifi.h"
 #include "../base.h"
+#include "../core.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -469,7 +470,7 @@ static void _rtl92s_dm_initial_gain_sta_beforeconnect(struct ieee80211_hw *hw)
                         if (digtable->backoff_enable_flag)
                                 rtl92s_backoff_enable_flag(hw);
                         else
-                                digtable->back_val = DM_DIG_BACKOFF;
+                                digtable->back_val = DM_DIG_BACKOFF_MAX;
 
                         if ((digtable->rssi_val + 10 - digtable->back_val) >
                                 digtable->rx_gain_max)
@@ -503,7 +504,7 @@ static void _rtl92s_dm_initial_gain_sta_beforeconnect(struct ieee80211_hw *hw)
                 digtable->dig_ext_port_stage = DIG_EXT_PORT_STAGE_MAX;
                 rtl92s_phy_set_fw_cmd(hw, FW_CMD_DIG_ENABLE);
 
-                digtable->back_val = DM_DIG_BACKOFF;
+                digtable->back_val = DM_DIG_BACKOFF_MAX;
                 digtable->cur_igvalue = rtlpriv->phy.default_initialgain[0];
                 digtable->pre_igvalue = 0;
                 return;
@@ -691,7 +692,7 @@ static void _rtl92s_dm_init_dig(struct ieee80211_hw *hw)
 
         /* for dig debug rssi value */
         digtable->rssi_val = 50;
-        digtable->back_val = DM_DIG_BACKOFF;
+        digtable->back_val = DM_DIG_BACKOFF_MAX;
         digtable->rx_gain_max = DM_DIG_MAX;
 
         digtable->rx_gain_min = DM_DIG_MIN;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/dm.h b/drivers/net/wireless/rtlwifi/rtl8192se/dm.h
index 2e9052c8fe4b..de6ac796c74d 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/dm.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/dm.h
@@ -54,24 +54,6 @@ enum dm_dig_sta {
         DM_STA_DIG_MAX
 };
 
-enum dm_dig_connect {
-        DIG_STA_DISCONNECT = 0,
-        DIG_STA_CONNECT = 1,
-        DIG_STA_BEFORE_CONNECT = 2,
-        DIG_AP_DISCONNECT = 3,
-        DIG_AP_CONNECT = 4,
-        DIG_AP_ADD_STATION = 5,
-        DIG_CONNECT_MAX
-};
-
-enum dm_dig_ext_port_alg {
-        DIG_EXT_PORT_STAGE_0 = 0,
-        DIG_EXT_PORT_STAGE_1 = 1,
-        DIG_EXT_PORT_STAGE_2 = 2,
-        DIG_EXT_PORT_STAGE_3 = 3,
-        DIG_EXT_PORT_STAGE_MAX = 4,
-};
-
 enum dm_ratr_sta {
         DM_RATR_STA_HIGH = 0,
         DM_RATR_STA_MIDDLEHIGH = 1,
@@ -99,22 +81,12 @@ enum dm_ratr_sta {
 #define TX_POWER_NEAR_FIELD_THRESH_LVL2 74
 #define TX_POWER_NEAR_FIELD_THRESH_LVL1 67
 
-#define DM_DIG_THRESH_HIGH              40
-#define DM_DIG_THRESH_LOW               35
-#define DM_FALSEALARM_THRESH_LOW        40
-#define DM_FALSEALARM_THRESH_HIGH       1000
 #define DM_DIG_HIGH_PWR_THRESH_HIGH     75
 #define DM_DIG_HIGH_PWR_THRESH_LOW      70
-#define DM_DIG_BACKOFF                  12
-#define DM_DIG_MAX                      0x3e
-#define DM_DIG_MIN                      0x1c
 #define DM_DIG_MIN_Netcore              0x12
-#define DM_DIG_BACKOFF_MAX              12
-#define DM_DIG_BACKOFF_MIN              -4
 
 void rtl92s_dm_watchdog(struct ieee80211_hw *hw);
 void rtl92s_dm_init(struct ieee80211_hw *hw);
 void rtl92s_dm_init_edca_turbo(struct ieee80211_hw *hw);
 
 #endif
-
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
index fb003868bdef..e1fd27c888bf 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
@@ -383,21 +383,21 @@ static struct rtl_hal_cfg rtl92se_hal_cfg = {
         .maps[RTL_IMR_ROK] = IMR_ROK,
         .maps[RTL_IBSS_INT_MASKS] = (IMR_BCNINT | IMR_TBDOK | IMR_TBDER),
 
-        .maps[RTL_RC_CCK_RATE1M] = DESC92_RATE1M,
-        .maps[RTL_RC_CCK_RATE2M] = DESC92_RATE2M,
-        .maps[RTL_RC_CCK_RATE5_5M] = DESC92_RATE5_5M,
-        .maps[RTL_RC_CCK_RATE11M] = DESC92_RATE11M,
-        .maps[RTL_RC_OFDM_RATE6M] = DESC92_RATE6M,
-        .maps[RTL_RC_OFDM_RATE9M] = DESC92_RATE9M,
-        .maps[RTL_RC_OFDM_RATE12M] = DESC92_RATE12M,
-        .maps[RTL_RC_OFDM_RATE18M] = DESC92_RATE18M,
-        .maps[RTL_RC_OFDM_RATE24M] = DESC92_RATE24M,
-        .maps[RTL_RC_OFDM_RATE36M] = DESC92_RATE36M,
-        .maps[RTL_RC_OFDM_RATE48M] = DESC92_RATE48M,
-        .maps[RTL_RC_OFDM_RATE54M] = DESC92_RATE54M,
-
-        .maps[RTL_RC_HT_RATEMCS7] = DESC92_RATEMCS7,
-        .maps[RTL_RC_HT_RATEMCS15] = DESC92_RATEMCS15,
+        .maps[RTL_RC_CCK_RATE1M] = DESC_RATE1M,
+        .maps[RTL_RC_CCK_RATE2M] = DESC_RATE2M,
+        .maps[RTL_RC_CCK_RATE5_5M] = DESC_RATE5_5M,
+        .maps[RTL_RC_CCK_RATE11M] = DESC_RATE11M,
+        .maps[RTL_RC_OFDM_RATE6M] = DESC_RATE6M,
+        .maps[RTL_RC_OFDM_RATE9M] = DESC_RATE9M,
+        .maps[RTL_RC_OFDM_RATE12M] = DESC_RATE12M,
+        .maps[RTL_RC_OFDM_RATE18M] = DESC_RATE18M,
+        .maps[RTL_RC_OFDM_RATE24M] = DESC_RATE24M,
+        .maps[RTL_RC_OFDM_RATE36M] = DESC_RATE36M,
+        .maps[RTL_RC_OFDM_RATE48M] = DESC_RATE48M,
+        .maps[RTL_RC_OFDM_RATE54M] = DESC_RATE54M,
+
+        .maps[RTL_RC_HT_RATEMCS7] = DESC_RATEMCS7,
+        .maps[RTL_RC_HT_RATEMCS15] = DESC_RATEMCS15,
 };
 
 static struct pci_device_id rtl92se_pci_ids[] = {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
index 672fd3b02835..125b29bd2f93 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
@@ -191,8 +191,8 @@ static void _rtl92se_query_rxphystatus(struct ieee80211_hw *hw,
                 pstats->rxpower = rx_pwr_all;
                 pstats->recvsignalpower = rx_pwr_all;
 
-                if (pstats->is_ht && pstats->rate >= DESC92_RATEMCS8 &&
-                    pstats->rate <= DESC92_RATEMCS15)
+                if (pstats->is_ht && pstats->rate >= DESC_RATEMCS8 &&
+                    pstats->rate <= DESC_RATEMCS15)
                         max_spatial_stream = 2;
                 else
                         max_spatial_stream = 1;
@@ -264,7 +264,6 @@ bool rtl92se_rx_query_desc(struct ieee80211_hw *hw, struct rtl_stats *stats,
         struct rx_fwinfo *p_drvinfo;
         u32 phystatus = (u32)GET_RX_STATUS_DESC_PHY_STATUS(pdesc);
         struct ieee80211_hdr *hdr;
-        bool first_ampdu = false;
 
         stats->length = (u16)GET_RX_STATUS_DESC_PKT_LEN(pdesc);
         stats->rx_drvinfo_size = (u8)GET_RX_STATUS_DESC_DRVINFO_SIZE(pdesc) * 8;
@@ -319,8 +318,8 @@ bool rtl92se_rx_query_desc(struct ieee80211_hw *hw, struct rtl_stats *stats,
                         rx_status->flag |= RX_FLAG_DECRYPTED;
         }
 
-        rx_status->rate_idx = rtlwifi_rate_mapping(hw,
-                              stats->is_ht, stats->rate, first_ampdu);
+        rx_status->rate_idx = rtlwifi_rate_mapping(hw, stats->is_ht,
+                                                   false, stats->rate);
 
         rx_status->mactime = stats->timestamp_low;
         if (phystatus) {
@@ -394,14 +393,14 @@ void rtl92se_tx_fill_desc(struct ieee80211_hw *hw,
                 SET_TX_DESC_RSVD_MACID(pdesc, reserved_macid);
 
                 SET_TX_DESC_TXHT(pdesc, ((ptcb_desc->hw_rate >=
-                                 DESC92_RATEMCS0) ? 1 : 0));
+                                 DESC_RATEMCS0) ? 1 : 0));
 
                 if (rtlhal->version == VERSION_8192S_ACUT) {
-                        if (ptcb_desc->hw_rate == DESC92_RATE1M ||
-                                ptcb_desc->hw_rate  == DESC92_RATE2M ||
-                                ptcb_desc->hw_rate == DESC92_RATE5_5M ||
-                                ptcb_desc->hw_rate == DESC92_RATE11M) {
-                                ptcb_desc->hw_rate = DESC92_RATE12M;
+                        if (ptcb_desc->hw_rate == DESC_RATE1M ||
+                            ptcb_desc->hw_rate  == DESC_RATE2M ||
+                            ptcb_desc->hw_rate == DESC_RATE5_5M ||
+                            ptcb_desc->hw_rate == DESC_RATE11M) {
+                                ptcb_desc->hw_rate = DESC_RATE12M;
                         }
                 }
 
@@ -430,7 +429,7 @@ void rtl92se_tx_fill_desc(struct ieee80211_hw *hw,
                 SET_TX_DESC_RTS_BANDWIDTH(pdesc, 0);
                 SET_TX_DESC_RTS_SUB_CARRIER(pdesc, ptcb_desc->rts_sc);
                 SET_TX_DESC_RTS_SHORT(pdesc, ((ptcb_desc->rts_rate <=
-                       DESC92_RATE54M) ?
+                       DESC_RATE54M) ?
                        (ptcb_desc->rts_use_shortpreamble ? 1 : 0)
                        : (ptcb_desc->rts_use_shortgi ? 1 : 0)));
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/dm.c b/drivers/net/wireless/rtlwifi/rtl8723ae/dm.c
index a0e86922780a..4c1c96c96a5a 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/dm.c
@@ -26,6 +26,7 @@
 #include "../wifi.h"
 #include "../base.h"
 #include "../pci.h"
+#include "../core.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -146,31 +147,6 @@ static const u8 cckswing_table_ch14[CCK_TABLE_SIZE][8] = {
         {0x09, 0x08, 0x07, 0x04, 0x00, 0x00, 0x00, 0x00}
 };
 
-static void rtl8723e_dm_diginit(struct ieee80211_hw *hw)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct dig_t *dm_digtable = &rtlpriv->dm_digtable;
-
-        dm_digtable->dig_enable_flag = true;
-        dm_digtable->dig_ext_port_stage = DIG_EXT_PORT_STAGE_MAX;
-        dm_digtable->cur_igvalue = 0x20;
-        dm_digtable->pre_igvalue = 0x0;
-        dm_digtable->cursta_cstate = DIG_STA_DISCONNECT;
-        dm_digtable->presta_cstate = DIG_STA_DISCONNECT;
-        dm_digtable->curmultista_cstate = DIG_MULTISTA_DISCONNECT;
-        dm_digtable->rssi_lowthresh = DM_DIG_THRESH_LOW;
-        dm_digtable->rssi_highthresh = DM_DIG_THRESH_HIGH;
-        dm_digtable->fa_lowthresh = DM_FALSEALARM_THRESH_LOW;
-        dm_digtable->fa_highthresh = DM_FALSEALARM_THRESH_HIGH;
-        dm_digtable->rx_gain_max = DM_DIG_MAX;
-        dm_digtable->rx_gain_min = DM_DIG_MIN;
-        dm_digtable->back_val = DM_DIG_BACKOFF_DEFAULT;
-        dm_digtable->back_range_max = DM_DIG_BACKOFF_MAX;
-        dm_digtable->back_range_min = DM_DIG_BACKOFF_MIN;
-        dm_digtable->pre_cck_pd_state = CCK_PD_STAGE_MAX;
-        dm_digtable->cur_cck_pd_state = CCK_PD_STAGE_MAX;
-}
-
 static u8 rtl8723e_dm_initial_gain_min_pwdb(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -395,30 +371,30 @@ static void rtl8723e_dm_cck_packet_detection_thresh(struct ieee80211_hw *hw)
         if (dm_digtable->cursta_cstate == DIG_STA_CONNECT) {
                 dm_digtable->rssi_val_min = rtl8723e_dm_initial_gain_min_pwdb(hw);
 
-                if (dm_digtable->pre_cck_pd_state == CCK_PD_STAGE_LowRssi) {
+                if (dm_digtable->pre_cck_pd_state == CCK_PD_STAGE_LOWRSSI) {
                         if (dm_digtable->rssi_val_min <= 25)
                                 dm_digtable->cur_cck_pd_state =
-                                    CCK_PD_STAGE_LowRssi;
+                                    CCK_PD_STAGE_LOWRSSI;
                         else
                                 dm_digtable->cur_cck_pd_state =
-                                    CCK_PD_STAGE_HighRssi;
+                                    CCK_PD_STAGE_HIGHRSSI;
                 } else {
                         if (dm_digtable->rssi_val_min <= 20)
                                 dm_digtable->cur_cck_pd_state =
-                                    CCK_PD_STAGE_LowRssi;
+                                    CCK_PD_STAGE_LOWRSSI;
                         else
                                 dm_digtable->cur_cck_pd_state =
-                                    CCK_PD_STAGE_HighRssi;
+                                    CCK_PD_STAGE_HIGHRSSI;
                 }
         } else {
                 dm_digtable->cur_cck_pd_state = CCK_PD_STAGE_MAX;
         }
 
         if (dm_digtable->pre_cck_pd_state != dm_digtable->cur_cck_pd_state) {
-                if (dm_digtable->cur_cck_pd_state == CCK_PD_STAGE_LowRssi) {
+                if (dm_digtable->cur_cck_pd_state == CCK_PD_STAGE_LOWRSSI) {
                         if (rtlpriv->falsealm_cnt.cnt_cck_fail > 800)
                                 dm_digtable->cur_cck_fa_state =
-                                    CCK_FA_STAGE_High;
+                                    CCK_FA_STAGE_HIGH;
                         else
                                 dm_digtable->cur_cck_fa_state =
                                     CCK_FA_STAGE_LOW;
@@ -818,7 +794,7 @@ void rtl8723e_dm_init(struct ieee80211_hw *hw)
         struct rtl_priv *rtlpriv = rtl_priv(hw);
 
         rtlpriv->dm.dm_type = DM_TYPE_BYDRIVER;
-        rtl8723e_dm_diginit(hw);
+        rtl_dm_diginit(hw, 0x20);
         rtl8723_dm_init_dynamic_txpower(hw);
         rtl8723_dm_init_edca_turbo(hw);
         rtl8723e_dm_init_rate_adaptive_mask(hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/dm.h b/drivers/net/wireless/rtlwifi/rtl8723ae/dm.h
index 6fa0feb05f6d..57111052e86b 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/dm.h
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/dm.h
@@ -42,25 +42,12 @@
 #define BW_AUTO_SWITCH_HIGH_LOW                 25
 #define BW_AUTO_SWITCH_LOW_HIGH                 30
 
-#define DM_DIG_THRESH_HIGH                      40
-#define DM_DIG_THRESH_LOW                       35
-
-#define DM_FALSEALARM_THRESH_LOW                400
-#define DM_FALSEALARM_THRESH_HIGH               1000
-
-#define DM_DIG_MAX                              0x3e
-#define DM_DIG_MIN                              0x1e
-
 #define DM_DIG_FA_UPPER                         0x32
 #define DM_DIG_FA_LOWER                         0x20
 #define DM_DIG_FA_TH0                           0x20
 #define DM_DIG_FA_TH1                           0x100
 #define DM_DIG_FA_TH2                           0x200
 
-#define DM_DIG_BACKOFF_MAX                      12
-#define DM_DIG_BACKOFF_MIN                      -4
-#define DM_DIG_BACKOFF_DEFAULT                  10
-
 #define RXPATHSELECTION_SS_TH_LOW               30
 #define RXPATHSELECTION_DIFF_TH                 18
 
@@ -108,14 +95,6 @@ enum tag_dynamic_init_gain_operation_type_definition {
         DIG_OP_TYPE_MAX
 };
 
-enum tag_cck_packet_detection_threshold_type_definition {
-        CCK_PD_STAGE_LowRssi = 0,
-        CCK_PD_STAGE_HighRssi = 1,
-        CCK_FA_STAGE_LOW = 2,
-        CCK_FA_STAGE_High = 3,
-        CCK_PD_STAGE_MAX = 4,
-};
-
 enum dm_1r_cca_e {
         CCA_1R = 0,
         CCA_2R = 1,
@@ -134,23 +113,6 @@ enum dm_sw_ant_switch_e {
         ANS_ANTENNA_MAX = 3,
 };
 
-enum dm_dig_ext_port_alg_e {
-        DIG_EXT_PORT_STAGE_0 = 0,
-        DIG_EXT_PORT_STAGE_1 = 1,
-        DIG_EXT_PORT_STAGE_2 = 2,
-        DIG_EXT_PORT_STAGE_3 = 3,
-        DIG_EXT_PORT_STAGE_MAX = 4,
-};
-
-enum dm_dig_connect_e {
-        DIG_STA_DISCONNECT = 0,
-        DIG_STA_CONNECT = 1,
-        DIG_STA_BEFORE_CONNECT = 2,
-        DIG_MULTISTA_DISCONNECT = 3,
-        DIG_MULTISTA_CONNECT = 4,
-        DIG_CONNECT_MAX
-};
-
 #define BT_RSSI_STATE_NORMAL_POWER      BIT_OFFSET_LEN_MASK_32(0, 1)
 #define BT_RSSI_STATE_AMDPU_OFF         BIT_OFFSET_LEN_MASK_32(1, 1)
 #define BT_RSSI_STATE_SPECIAL_LOW       BIT_OFFSET_LEN_MASK_32(2, 1)
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c b/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
index d372ccaf3465..2f7c144d7980 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
@@ -45,164 +45,6 @@ static u8 _rtl8723e_map_hwqueue_to_fwqueue(struct sk_buff *skb, u8 hw_queue)
         return skb->priority;
 }
 
-/* mac80211's rate_idx is like this:
- *
- * 2.4G band:rx_status->band == IEEE80211_BAND_2GHZ
- *
- * B/G rate:
- * (rx_status->flag & RX_FLAG_HT) = 0,
- * DESC92C_RATE1M-->DESC92C_RATE54M ==> idx is 0-->11,
- *
- * N rate:
- * (rx_status->flag & RX_FLAG_HT) = 1,
- * DESC92C_RATEMCS0-->DESC92C_RATEMCS15 ==> idx is 0-->15
- *
- * 5G band:rx_status->band == IEEE80211_BAND_5GHZ
- * A rate:
- * (rx_status->flag & RX_FLAG_HT) = 0,
- * DESC92C_RATE6M-->DESC92C_RATE54M ==> idx is 0-->7,
- *
- * N rate:
- * (rx_status->flag & RX_FLAG_HT) = 1,
- * DESC92C_RATEMCS0-->DESC92C_RATEMCS15 ==> idx is 0-->15
- */
-static int _rtl8723e_rate_mapping(struct ieee80211_hw *hw,
-                                  bool isht, u8 desc_rate)
-{
-        int rate_idx;
-
-        if (!isht) {
-                if (IEEE80211_BAND_2GHZ == hw->conf.chandef.chan->band) {
-                        switch (desc_rate) {
-                        case DESC92C_RATE1M:
-                                rate_idx = 0;
-                                break;
-                        case DESC92C_RATE2M:
-                                rate_idx = 1;
-                                break;
-                        case DESC92C_RATE5_5M:
-                                rate_idx = 2;
-                                break;
-                        case DESC92C_RATE11M:
-                                rate_idx = 3;
-                                break;
-                        case DESC92C_RATE6M:
-                                rate_idx = 4;
-                                break;
-                        case DESC92C_RATE9M:
-                                rate_idx = 5;
-                                break;
-                        case DESC92C_RATE12M:
-                                rate_idx = 6;
-                                break;
-                        case DESC92C_RATE18M:
-                                rate_idx = 7;
-                                break;
-                        case DESC92C_RATE24M:
-                                rate_idx = 8;
-                                break;
-                        case DESC92C_RATE36M:
-                                rate_idx = 9;
-                                break;
-                        case DESC92C_RATE48M:
-                                rate_idx = 10;
-                                break;
-                        case DESC92C_RATE54M:
-                                rate_idx = 11;
-                                break;
-                        default:
-                                rate_idx = 0;
-                                break;
-                        }
-                } else {
-                        switch (desc_rate) {
-                        case DESC92C_RATE6M:
-                                rate_idx = 0;
-                                break;
-                        case DESC92C_RATE9M:
-                                rate_idx = 1;
-                                break;
-                        case DESC92C_RATE12M:
-                                rate_idx = 2;
-                                break;
-                        case DESC92C_RATE18M:
-                                rate_idx = 3;
-                                break;
-                        case DESC92C_RATE24M:
-                                rate_idx = 4;
-                                break;
-                        case DESC92C_RATE36M:
-                                rate_idx = 5;
-                                break;
-                        case DESC92C_RATE48M:
-                                rate_idx = 6;
-                                break;
-                        case DESC92C_RATE54M:
-                                rate_idx = 7;
-                                break;
-                        default:
-                                rate_idx = 0;
-                                break;
-                        }
-                }
-        } else {
-                switch (desc_rate) {
-                case DESC92C_RATEMCS0:
-                        rate_idx = 0;
-                        break;
-                case DESC92C_RATEMCS1:
-                        rate_idx = 1;
-                        break;
-                case DESC92C_RATEMCS2:
-                        rate_idx = 2;
-                        break;
-                case DESC92C_RATEMCS3:
-                        rate_idx = 3;
-                        break;
-                case DESC92C_RATEMCS4:
-                        rate_idx = 4;
-                        break;
-                case DESC92C_RATEMCS5:
-                        rate_idx = 5;
-                        break;
-                case DESC92C_RATEMCS6:
-                        rate_idx = 6;
-                        break;
-                case DESC92C_RATEMCS7:
-                        rate_idx = 7;
-                        break;
-                case DESC92C_RATEMCS8:
-                        rate_idx = 8;
-                        break;
-                case DESC92C_RATEMCS9:
-                        rate_idx = 9;
-                        break;
-                case DESC92C_RATEMCS10:
-                        rate_idx = 10;
-                        break;
-                case DESC92C_RATEMCS11:
-                        rate_idx = 11;
-                        break;
-                case DESC92C_RATEMCS12:
-                        rate_idx = 12;
-                        break;
-                case DESC92C_RATEMCS13:
-                        rate_idx = 13;
-                        break;
-                case DESC92C_RATEMCS14:
-                        rate_idx = 14;
-                        break;
-                case DESC92C_RATEMCS15:
-                        rate_idx = 15;
-                        break;
-                default:
-                        rate_idx = 0;
-                        break;
-                }
-        }
-        return rate_idx;
-}
-
 static void _rtl8723e_query_rxphystatus(struct ieee80211_hw *hw,
                                         struct rtl_stats *pstatus, u8 *pdesc,
                                         struct rx_fwinfo_8723e *p_drvinfo,
@@ -503,8 +345,8 @@ bool rtl8723e_rx_query_desc(struct ieee80211_hw *hw,
          * are use (RX_FLAG_HT)
          * Notice: this is diff with windows define
          */
-        rx_status->rate_idx = _rtl8723e_rate_mapping(hw,
-                                status->is_ht, status->rate);
+        rx_status->rate_idx = rtlwifi_rate_mapping(hw, status->is_ht,
+                                                   false, status->rate);
 
         rx_status->mactime = status->timestamp_low;
         if (phystatus == true) {
diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/dm.c b/drivers/net/wireless/rtlwifi/rtl8723be/dm.c
index dd7eb4371f49..2367e8f47a5b 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723be/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723be/dm.c
@@ -26,6 +26,7 @@
 #include "../wifi.h"
 #include "../base.h"
 #include "../pci.h"
+#include "../core.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -211,35 +212,6 @@ void rtl8723be_dm_txpower_track_adjust(struct ieee80211_hw *hw, u8 type,
                 (pwr_val << 16) | (pwr_val << 24);
 }
 
-static void rtl8723be_dm_diginit(struct ieee80211_hw *hw)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct dig_t *dm_digtable = &rtlpriv->dm_digtable;
-
-        dm_digtable->dig_enable_flag = true;
-        dm_digtable->cur_igvalue = rtl_get_bbreg(hw, ROFDM0_XAAGCCORE1, 0x7f);
-        dm_digtable->rssi_lowthresh = DM_DIG_THRESH_LOW;
-        dm_digtable->rssi_highthresh = DM_DIG_THRESH_HIGH;
-        dm_digtable->fa_lowthresh = DM_FALSEALARM_THRESH_LOW;
-        dm_digtable->fa_highthresh = DM_FALSEALARM_THRESH_HIGH;
-        dm_digtable->rx_gain_max = DM_DIG_MAX;
-        dm_digtable->rx_gain_min = DM_DIG_MIN;
-        dm_digtable->back_val = DM_DIG_BACKOFF_DEFAULT;
-        dm_digtable->back_range_max = DM_DIG_BACKOFF_MAX;
-        dm_digtable->back_range_min = DM_DIG_BACKOFF_MIN;
-        dm_digtable->pre_cck_cca_thres = 0xff;
-        dm_digtable->cur_cck_cca_thres = 0x83;
-        dm_digtable->forbidden_igi = DM_DIG_MIN;
-        dm_digtable->large_fa_hit = 0;
-        dm_digtable->recover_cnt = 0;
-        dm_digtable->dig_dynamic_min = DM_DIG_MIN;
-        dm_digtable->dig_dynamic_min_1 = DM_DIG_MIN;
-        dm_digtable->media_connect_0 = false;
-        dm_digtable->media_connect_1 = false;
-        rtlpriv->dm.dm_initialgain_enable = true;
-        dm_digtable->bt30_cur_igi = 0x32;
-}
-
 void rtl8723be_dm_init_rate_adaptive_mask(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -293,9 +265,10 @@ static void rtl8723be_dm_init_dynamic_atc_switch(struct ieee80211_hw *hw)
 void rtl8723be_dm_init(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u32 cur_igvalue = rtl_get_bbreg(hw, ROFDM0_XAAGCCORE1, 0x7f);
 
         rtlpriv->dm.dm_type = DM_TYPE_BYDRIVER;
-        rtl8723be_dm_diginit(hw);
+        rtl_dm_diginit(hw, cur_igvalue);
         rtl8723be_dm_init_rate_adaptive_mask(hw);
         rtl8723_dm_init_edca_turbo(hw);
         rtl8723_dm_init_dynamic_bb_powersaving(hw);
@@ -424,7 +397,7 @@ static void rtl8723be_dm_dig(struct ieee80211_hw *hw)
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct dig_t *dm_digtable = &rtlpriv->dm_digtable;
         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
-        u8 dig_dynamic_min, dig_maxofmin;
+        u8 dig_min_0, dig_maxofmin;
         bool bfirstconnect, bfirstdisconnect;
         u8 dm_dig_max, dm_dig_min;
         u8 current_igi = dm_digtable->cur_igvalue;
@@ -434,7 +407,7 @@ static void rtl8723be_dm_dig(struct ieee80211_hw *hw)
         if (mac->act_scanning)
                 return;
 
-        dig_dynamic_min = dm_digtable->dig_dynamic_min;
+        dig_min_0 = dm_digtable->dig_min_0;
         bfirstconnect = (mac->link_state >= MAC80211_LINKED) &&
                         !dm_digtable->media_connect_0;
         bfirstdisconnect = (mac->link_state < MAC80211_LINKED) &&
@@ -456,20 +429,20 @@ static void rtl8723be_dm_dig(struct ieee80211_hw *hw)
                 if (rtlpriv->dm.one_entry_only) {
                         offset = 12;
                         if (dm_digtable->rssi_val_min - offset < dm_dig_min)
-                                dig_dynamic_min = dm_dig_min;
+                                dig_min_0 = dm_dig_min;
                         else if (dm_digtable->rssi_val_min - offset >
                                                         dig_maxofmin)
-                                dig_dynamic_min = dig_maxofmin;
+                                dig_min_0 = dig_maxofmin;
                         else
-                                dig_dynamic_min =
+                                dig_min_0 =
                                         dm_digtable->rssi_val_min - offset;
                 } else {
-                        dig_dynamic_min = dm_dig_min;
+                        dig_min_0 = dm_dig_min;
                 }
 
         } else {
                 dm_digtable->rx_gain_max = dm_dig_max;
-                dig_dynamic_min = dm_dig_min;
+                dig_min_0 = dm_dig_min;
                 RT_TRACE(rtlpriv, COMP_DIG, DBG_LOUD, "no link\n");
         }
 
@@ -497,11 +470,11 @@ static void rtl8723be_dm_dig(struct ieee80211_hw *hw)
                 } else {
                         if (dm_digtable->large_fa_hit < 3) {
                                 if ((dm_digtable->forbidden_igi - 1) <
-                                     dig_dynamic_min) {
+                                     dig_min_0) {
                                         dm_digtable->forbidden_igi =
-                                                        dig_dynamic_min;
+                                                        dig_min_0;
                                         dm_digtable->rx_gain_min =
-                                                        dig_dynamic_min;
+                                                        dig_min_0;
                                 } else {
                                         dm_digtable->forbidden_igi--;
                                         dm_digtable->rx_gain_min =
@@ -552,7 +525,7 @@ static void rtl8723be_dm_dig(struct ieee80211_hw *hw)
         rtl8723be_dm_write_dig(hw, current_igi);
         dm_digtable->media_connect_0 =
                 ((mac->link_state >= MAC80211_LINKED) ? true : false);
-        dm_digtable->dig_dynamic_min = dig_dynamic_min;
+        dm_digtable->dig_min_0 = dig_min_0;
 }
 
 static void rtl8723be_dm_false_alarm_counter_statistics(
diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/dm.h b/drivers/net/wireless/rtlwifi/rtl8723be/dm.h
index e4c0e8ae6f47..f752a2cad63d 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723be/dm.h
+++ b/drivers/net/wireless/rtlwifi/rtl8723be/dm.h
@@ -180,28 +180,12 @@
 #define BW_AUTO_SWITCH_HIGH_LOW                 25
 #define BW_AUTO_SWITCH_LOW_HIGH                 30
 
-#define DM_DIG_THRESH_HIGH                      40
-#define DM_DIG_THRESH_LOW                       35
-
-#define DM_FALSEALARM_THRESH_LOW                400
-#define DM_FALSEALARM_THRESH_HIGH               1000
-
-#define DM_DIG_MAX                              0x3e
-#define DM_DIG_MIN                              0x1e
-
-#define DM_DIG_MAX_AP                           0x32
-#define DM_DIG_MIN_AP                           0x20
-
 #define DM_DIG_FA_UPPER                         0x3e
 #define DM_DIG_FA_LOWER                         0x1e
 #define DM_DIG_FA_TH0                           0x200
 #define DM_DIG_FA_TH1                           0x300
 #define DM_DIG_FA_TH2                           0x400
 
-#define DM_DIG_BACKOFF_MAX                      12
-#define DM_DIG_BACKOFF_MIN                      -4
-#define DM_DIG_BACKOFF_DEFAULT                  10
-
 #define RXPATHSELECTION_SS_TH_LOW               30
 #define RXPATHSELECTION_DIFF_TH                 18
 
@@ -252,23 +236,6 @@ enum dm_sw_ant_switch_e {
         ANS_ANTENNA_MAX = 3,
 };
 
-enum dm_dig_ext_port_alg_e {
-        DIG_EXT_PORT_STAGE_0    = 0,
-        DIG_EXT_PORT_STAGE_1    = 1,
-        DIG_EXT_PORT_STAGE_2    = 2,
-        DIG_EXT_PORT_STAGE_3    = 3,
-        DIG_EXT_PORT_STAGE_MAX  = 4,
-};
-
-enum dm_dig_connect_e {
-        DIG_STA_DISCONNECT      = 0,
-        DIG_STA_CONNECT         = 1,
-        DIG_STA_BEFORE_CONNECT  = 2,
-        DIG_MULTISTA_DISCONNECT = 3,
-        DIG_MULTISTA_CONNECT    = 4,
-        DIG_CONNECT_MAX
-};
-
 enum pwr_track_control_method {
         BBSWING,
         TXAGC
diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/phy.c b/drivers/net/wireless/rtlwifi/rtl8723be/phy.c
index 20dcc25c506c..b7b73cbe346d 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723be/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723be/phy.c
@@ -874,31 +874,6 @@ void rtl8723be_phy_get_hw_reg_originalvalue(struct ieee80211_hw *hw)
                   ROFDM0_RXDETECTOR3, rtlphy->framesync);
 }
 
-void rtl8723be_phy_get_txpower_level(struct ieee80211_hw *hw, long *powerlevel)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_phy *rtlphy = &rtlpriv->phy;
-        u8 txpwr_level;
-        long txpwr_dbm;
-
-        txpwr_level = rtlphy->cur_cck_txpwridx;
-        txpwr_dbm = rtl8723_phy_txpwr_idx_to_dbm(hw, WIRELESS_MODE_B,
-                                                 txpwr_level);
-        txpwr_level = rtlphy->cur_ofdm24g_txpwridx;
-        if (rtl8723_phy_txpwr_idx_to_dbm(hw, WIRELESS_MODE_G, txpwr_level) >
-            txpwr_dbm)
-                txpwr_dbm =
-                    rtl8723_phy_txpwr_idx_to_dbm(hw, WIRELESS_MODE_G,
-                                                 txpwr_level);
-        txpwr_level = rtlphy->cur_ofdm24g_txpwridx;
-        if (rtl8723_phy_txpwr_idx_to_dbm(hw, WIRELESS_MODE_N_24G,
-                                         txpwr_level) > txpwr_dbm)
-                txpwr_dbm =
-                    rtl8723_phy_txpwr_idx_to_dbm(hw, WIRELESS_MODE_N_24G,
-                                                 txpwr_level);
-        *powerlevel = txpwr_dbm;
-}
-
 static u8 _rtl8723be_phy_get_ratesection_intxpower_byrate(enum radio_path path,
                                                           u8 rate)
 {
diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/phy.h b/drivers/net/wireless/rtlwifi/rtl8723be/phy.h
index 6339738a0e33..9021d4745ab7 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723be/phy.h
+++ b/drivers/net/wireless/rtlwifi/rtl8723be/phy.h
@@ -114,8 +114,6 @@ bool rtl8723be_phy_mac_config(struct ieee80211_hw *hw);
 bool rtl8723be_phy_bb_config(struct ieee80211_hw *hw);
 bool rtl8723be_phy_rf_config(struct ieee80211_hw *hw);
 void rtl8723be_phy_get_hw_reg_originalvalue(struct ieee80211_hw *hw);
-void rtl8723be_phy_get_txpower_level(struct ieee80211_hw *hw,
-                                     long *powerlevel);
 void rtl8723be_phy_set_txpower_level(struct ieee80211_hw *hw,
                                      u8 channel);
 void rtl8723be_phy_scan_operation_backup(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/sw.c b/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
index 223eb42992bd..1017f02d7bf7 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
@@ -387,12 +387,14 @@ module_param_named(swlps, rtl8723be_mod_params.swctrl_lps, bool, 0444);
 module_param_named(fwlps, rtl8723be_mod_params.fwctrl_lps, bool, 0444);
 module_param_named(disable_watchdog, rtl8723be_mod_params.disable_watchdog,
                    bool, 0444);
-MODULE_PARM_DESC(swenc, "using hardware crypto (default 0 [hardware])\n");
-MODULE_PARM_DESC(ips, "using no link power save (default 1 is open)\n");
-MODULE_PARM_DESC(fwlps, "using linked fw control power save (default 1 is open)\n");
+MODULE_PARM_DESC(swenc, "Set to 1 for software crypto (default 0)\n");
+MODULE_PARM_DESC(ips, "Set to 0 to not use link power save (default 1)\n");
+MODULE_PARM_DESC(swlps, "Set to 1 to use SW control power save (default 0)\n");
+MODULE_PARM_DESC(fwlps, "Set to 1 to use FW control power save (default 1)\n");
 MODULE_PARM_DESC(msi, "Set to 1 to use MSI interrupts mode (default 0)\n");
 MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)");
-MODULE_PARM_DESC(disable_watchdog, "Set to 1 to disable the watchdog (default 0)\n");
+MODULE_PARM_DESC(disable_watchdog,
+                 "Set to 1 to disable the watchdog (default 0)\n");
 
 static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume);
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/trx.c b/drivers/net/wireless/rtlwifi/rtl8723be/trx.c
index d6a1c70cb657..338ec9a9d09b 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723be/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723be/trx.c
@@ -47,164 +47,6 @@ static u8 _rtl8723be_map_hwqueue_to_fwqueue(struct sk_buff *skb, u8 hw_queue)
         return skb->priority;
 }
 
-/* mac80211's rate_idx is like this:
- *
- * 2.4G band:rx_status->band == IEEE80211_BAND_2GHZ
- *
- * B/G rate:
- * (rx_status->flag & RX_FLAG_HT) = 0,
- * DESC92C_RATE1M-->DESC92C_RATE54M ==> idx is 0-->11,
- *
- * N rate:
- * (rx_status->flag & RX_FLAG_HT) = 1,
- * DESC92C_RATEMCS0-->DESC92C_RATEMCS15 ==> idx is 0-->15
- *
- * 5G band:rx_status->band == IEEE80211_BAND_5GHZ
- * A rate:
- * (rx_status->flag & RX_FLAG_HT) = 0,
- * DESC92C_RATE6M-->DESC92C_RATE54M ==> idx is 0-->7,
- *
- * N rate:
- * (rx_status->flag & RX_FLAG_HT) = 1,
- * DESC92C_RATEMCS0-->DESC92C_RATEMCS15 ==> idx is 0-->15
- */
-static int _rtl8723be_rate_mapping(struct ieee80211_hw *hw,
-                                   bool isht, u8 desc_rate)
-{
-        int rate_idx;
-
-        if (!isht) {
-                if (IEEE80211_BAND_2GHZ == hw->conf.chandef.chan->band) {
-                        switch (desc_rate) {
-                        case DESC92C_RATE1M:
-                                rate_idx = 0;
-                                break;
-                        case DESC92C_RATE2M:
-                                rate_idx = 1;
-                                break;
-                        case DESC92C_RATE5_5M:
-                                rate_idx = 2;
-                                break;
-                        case DESC92C_RATE11M:
-                                rate_idx = 3;
-                                break;
-                        case DESC92C_RATE6M:
-                                rate_idx = 4;
-                                break;
-                        case DESC92C_RATE9M:
-                                rate_idx = 5;
-                                break;
-                        case DESC92C_RATE12M:
-                                rate_idx = 6;
-                                break;
-                        case DESC92C_RATE18M:
-                                rate_idx = 7;
-                                break;
-                        case DESC92C_RATE24M:
-                                rate_idx = 8;
-                                break;
-                        case DESC92C_RATE36M:
-                                rate_idx = 9;
-                                break;
-                        case DESC92C_RATE48M:
-                                rate_idx = 10;
-                                break;
-                        case DESC92C_RATE54M:
-                                rate_idx = 11;
-                                break;
-                        default:
-                                rate_idx = 0;
-                                break;
-                        }
-                } else {
-                        switch (desc_rate) {
-                        case DESC92C_RATE6M:
-                                rate_idx = 0;
-                                break;
-                        case DESC92C_RATE9M:
-                                rate_idx = 1;
-                                break;
-                        case DESC92C_RATE12M:
-                                rate_idx = 2;
-                                break;
-                        case DESC92C_RATE18M:
-                                rate_idx = 3;
-                                break;
-                        case DESC92C_RATE24M:
-                                rate_idx = 4;
-                                break;
-                        case DESC92C_RATE36M:
-                                rate_idx = 5;
-                                break;
-                        case DESC92C_RATE48M:
-                                rate_idx = 6;
-                                break;
-                        case DESC92C_RATE54M:
-                                rate_idx = 7;
-                                break;
-                        default:
-                                rate_idx = 0;
-                                break;
-                        }
-                }
-        } else {
-                switch (desc_rate) {
-                case DESC92C_RATEMCS0:
-                        rate_idx = 0;
-                        break;
-                case DESC92C_RATEMCS1:
-                        rate_idx = 1;
-                        break;
-                case DESC92C_RATEMCS2:
-                        rate_idx = 2;
-                        break;
-                case DESC92C_RATEMCS3:
-                        rate_idx = 3;
-                        break;
-                case DESC92C_RATEMCS4:
-                        rate_idx = 4;
-                        break;
-                case DESC92C_RATEMCS5:
-                        rate_idx = 5;
-                        break;
-                case DESC92C_RATEMCS6:
-                        rate_idx = 6;
-                        break;
-                case DESC92C_RATEMCS7:
-                        rate_idx = 7;
-                        break;
-                case DESC92C_RATEMCS8:
-                        rate_idx = 8;
-                        break;
-                case DESC92C_RATEMCS9:
-                        rate_idx = 9;
-                        break;
-                case DESC92C_RATEMCS10:
-                        rate_idx = 10;
-                        break;
-                case DESC92C_RATEMCS11:
-                        rate_idx = 11;
-                        break;
-                case DESC92C_RATEMCS12:
-                        rate_idx = 12;
-                        break;
-                case DESC92C_RATEMCS13:
-                        rate_idx = 13;
-                        break;
-                case DESC92C_RATEMCS14:
-                        rate_idx = 14;
-                        break;
-                case DESC92C_RATEMCS15:
-                        rate_idx = 15;
-                        break;
-                default:
-                        rate_idx = 0;
-                        break;
-                }
-        }
-        return rate_idx;
-}
-
 static void _rtl8723be_query_rxphystatus(struct ieee80211_hw *hw,
                                          struct rtl_stats *pstatus, u8 *pdesc,
                                          struct rx_fwinfo_8723be *p_drvinfo,
@@ -558,8 +400,8 @@ bool rtl8723be_rx_query_desc(struct ieee80211_hw *hw,
          * supported rates or MCS index if HT rates
          * are use (RX_FLAG_HT)
          */
-        rx_status->rate_idx = _rtl8723be_rate_mapping(hw, status->is_ht,
-                                                      status->rate);
+        rx_status->rate_idx = rtlwifi_rate_mapping(hw, status->is_ht,
+                                                   false, status->rate);
 
         rx_status->mactime = status->timestamp_low;
         if (phystatus) {
diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/def.h b/drivers/net/wireless/rtlwifi/rtl8821ae/def.h
index a730985ae81d..ee7c208bd070 100644
--- a/drivers/net/wireless/rtlwifi/rtl8821ae/def.h
+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/def.h
@@ -373,60 +373,6 @@ enum rtl_desc_qsel {
         QSLT_CMD = 0x13,
 };
 
-enum rtl_desc8821ae_rate {
-        DESC_RATE1M = 0x00,
-        DESC_RATE2M = 0x01,
-        DESC_RATE5_5M = 0x02,
-        DESC_RATE11M = 0x03,
-
-        DESC_RATE6M = 0x04,
-        DESC_RATE9M = 0x05,
-        DESC_RATE12M = 0x06,
-        DESC_RATE18M = 0x07,
-        DESC_RATE24M = 0x08,
-        DESC_RATE36M = 0x09,
-        DESC_RATE48M = 0x0a,
-        DESC_RATE54M = 0x0b,
-
-        DESC_RATEMCS0 = 0x0c,
-        DESC_RATEMCS1 = 0x0d,
-        DESC_RATEMCS2 = 0x0e,
-        DESC_RATEMCS3 = 0x0f,
-        DESC_RATEMCS4 = 0x10,
-        DESC_RATEMCS5 = 0x11,
-        DESC_RATEMCS6 = 0x12,
-        DESC_RATEMCS7 = 0x13,
-        DESC_RATEMCS8 = 0x14,
-        DESC_RATEMCS9 = 0x15,
-        DESC_RATEMCS10 = 0x16,
-        DESC_RATEMCS11 = 0x17,
-        DESC_RATEMCS12 = 0x18,
-        DESC_RATEMCS13 = 0x19,
-        DESC_RATEMCS14 = 0x1a,
-        DESC_RATEMCS15 = 0x1b,
-
-        DESC_RATEVHT1SS_MCS0 = 0x2c,
-        DESC_RATEVHT1SS_MCS1 = 0x2d,
-        DESC_RATEVHT1SS_MCS2 = 0x2e,
-        DESC_RATEVHT1SS_MCS3 = 0x2f,
-        DESC_RATEVHT1SS_MCS4 = 0x30,
-        DESC_RATEVHT1SS_MCS5 = 0x31,
-        DESC_RATEVHT1SS_MCS6 = 0x32,
-        DESC_RATEVHT1SS_MCS7 = 0x33,
-        DESC_RATEVHT1SS_MCS8 = 0x34,
-        DESC_RATEVHT1SS_MCS9 = 0x35,
-        DESC_RATEVHT2SS_MCS0 = 0x36,
-        DESC_RATEVHT2SS_MCS1 = 0x37,
-        DESC_RATEVHT2SS_MCS2 = 0x38,
-        DESC_RATEVHT2SS_MCS3 = 0x39,
-        DESC_RATEVHT2SS_MCS4 = 0x3a,
-        DESC_RATEVHT2SS_MCS5 = 0x3b,
-        DESC_RATEVHT2SS_MCS6 = 0x3c,
-        DESC_RATEVHT2SS_MCS7 = 0x3d,
-        DESC_RATEVHT2SS_MCS8 = 0x3e,
-        DESC_RATEVHT2SS_MCS9 = 0x3f,
-};
-
 enum rx_packet_type {
         NORMAL_RX,
         TX_REPORT1,
diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/dm.c b/drivers/net/wireless/rtlwifi/rtl8821ae/dm.c
index ba30b0d250fd..0b2082dc48f1 100644
--- a/drivers/net/wireless/rtlwifi/rtl8821ae/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/dm.c
@@ -26,6 +26,7 @@
 #include "../wifi.h"
 #include "../base.h"
 #include "../pci.h"
+#include "../core.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -519,34 +520,6 @@ void rtl8821ae_dm_initialize_txpower_tracking_thermalmeter(
         }
 }
 
-static void rtl8821ae_dm_diginit(struct ieee80211_hw *hw)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct dig_t *dm_digtable = &rtlpriv->dm_digtable;
-
-        dm_digtable->cur_igvalue = rtl_get_bbreg(hw, ROFDM0_XAAGCCORE1, 0x7f);
-        dm_digtable->rssi_lowthresh = DM_DIG_THRESH_LOW;
-        dm_digtable->rssi_highthresh = DM_DIG_THRESH_HIGH;
-        dm_digtable->fa_lowthresh = DM_FALSEALARM_THRESH_LOW;
-        dm_digtable->fa_highthresh = DM_FALSEALARM_THRESH_HIGH;
-        dm_digtable->rx_gain_max = DM_DIG_MAX;
-        dm_digtable->rx_gain_min = DM_DIG_MIN;
-        dm_digtable->back_val = DM_DIG_BACKOFF_DEFAULT;
-        dm_digtable->back_range_max = DM_DIG_BACKOFF_MAX;
-        dm_digtable->back_range_min = DM_DIG_BACKOFF_MIN;
-        dm_digtable->pre_cck_cca_thres = 0xff;
-        dm_digtable->cur_cck_cca_thres = 0x83;
-        dm_digtable->forbidden_igi = DM_DIG_MIN;
-        dm_digtable->large_fa_hit = 0;
-        dm_digtable->recover_cnt = 0;
-        dm_digtable->dig_dynamic_min = DM_DIG_MIN;
-        dm_digtable->dig_dynamic_min_1 = DM_DIG_MIN;
-        dm_digtable->media_connect_0 = false;
-        dm_digtable->media_connect_1 = false;
-        rtlpriv->dm.dm_initialgain_enable = true;
-        dm_digtable->bt30_cur_igi = 0x32;
-}
-
 void rtl8821ae_dm_init_edca_turbo(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -606,6 +579,7 @@ void rtl8821ae_dm_init(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_phy *rtlphy = &rtlpriv->phy;
+        u32 cur_igvalue = rtl_get_bbreg(hw, ROFDM0_XAAGCCORE1, 0x7f);
 
         spin_lock(&rtlpriv->locks.iqk_lock);
         rtlphy->lck_inprogress = false;
@@ -613,7 +587,7 @@ void rtl8821ae_dm_init(struct ieee80211_hw *hw)
 
         rtlpriv->dm.dm_type = DM_TYPE_BYDRIVER;
         rtl8821ae_dm_common_info_self_init(hw);
-        rtl8821ae_dm_diginit(hw);
+        rtl_dm_diginit(hw, cur_igvalue);
         rtl8821ae_dm_init_rate_adaptive_mask(hw);
         rtl8821ae_dm_init_edca_turbo(hw);
         rtl8821ae_dm_initialize_txpower_tracking_thermalmeter(hw);
@@ -822,7 +796,7 @@ static void rtl8821ae_dm_dig(struct ieee80211_hw *hw)
         struct dig_t *dm_digtable = &rtlpriv->dm_digtable;
         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
         struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
-        u8 dig_dynamic_min;
+        u8 dig_min_0;
         u8 dig_max_of_min;
         bool first_connect, first_disconnect;
         u8 dm_dig_max, dm_dig_min, offset;
@@ -837,7 +811,7 @@ static void rtl8821ae_dm_dig(struct ieee80211_hw *hw)
         }
 
         /*add by Neil Chen to avoid PSD is processing*/
-        dig_dynamic_min = dm_digtable->dig_dynamic_min;
+        dig_min_0 = dm_digtable->dig_min_0;
         first_connect = (mac->link_state >= MAC80211_LINKED) &&
                         (!dm_digtable->media_connect_0);
         first_disconnect = (mac->link_state < MAC80211_LINKED) &&
@@ -876,23 +850,23 @@ static void rtl8821ae_dm_dig(struct ieee80211_hw *hw)
                         offset = 0;
 
                         if (dm_digtable->rssi_val_min - offset < dm_dig_min)
-                                dig_dynamic_min = dm_dig_min;
+                                dig_min_0 = dm_dig_min;
                         else if (dm_digtable->rssi_val_min -
                                 offset > dig_max_of_min)
-                                dig_dynamic_min = dig_max_of_min;
+                                dig_min_0 = dig_max_of_min;
                         else
-                                dig_dynamic_min =
+                                dig_min_0 =
                                         dm_digtable->rssi_val_min - offset;
 
                         RT_TRACE(rtlpriv, COMP_DIG, DBG_LOUD,
-                                 "bOneEntryOnly=TRUE, dig_dynamic_min=0x%x\n",
-                                 dig_dynamic_min);
+                                 "bOneEntryOnly=TRUE, dig_min_0=0x%x\n",
+                                 dig_min_0);
                 } else {
-                        dig_dynamic_min = dm_dig_min;
+                        dig_min_0 = dm_dig_min;
                 }
         } else {
                 dm_digtable->rx_gain_max = dm_dig_max;
-                dig_dynamic_min = dm_dig_min;
+                dig_min_0 = dm_dig_min;
                 RT_TRACE(rtlpriv, COMP_DIG, DBG_LOUD,
                          "No Link\n");
         }
@@ -925,11 +899,11 @@ static void rtl8821ae_dm_dig(struct ieee80211_hw *hw)
                 } else {
                         if (dm_digtable->large_fa_hit < 3) {
                                 if ((dm_digtable->forbidden_igi - 1) <
-                                    dig_dynamic_min) {
+                                    dig_min_0) {
                                         dm_digtable->forbidden_igi =
-                                                dig_dynamic_min;
+                                                dig_min_0;
                                         dm_digtable->rx_gain_min =
-                                                dig_dynamic_min;
+                                                dig_min_0;
                                         RT_TRACE(rtlpriv, COMP_DIG, DBG_LOUD,
                                                  "Normal Case: At Lower Bound\n");
                                 } else {
@@ -1024,7 +998,7 @@ static void rtl8821ae_dm_dig(struct ieee80211_hw *hw)
         rtl8821ae_dm_write_dig(hw, current_igi);
         dm_digtable->media_connect_0 =
                 ((mac->link_state >= MAC80211_LINKED) ? true : false);
-        dm_digtable->dig_dynamic_min = dig_dynamic_min;
+        dm_digtable->dig_min_0 = dig_min_0;
 }
 
 static void rtl8821ae_dm_common_info_self_update(struct ieee80211_hw *hw)
diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/dm.h b/drivers/net/wireless/rtlwifi/rtl8821ae/dm.h
index 9dd40dd316c1..625a6bbb21fc 100644
--- a/drivers/net/wireless/rtlwifi/rtl8821ae/dm.h
+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/dm.h
@@ -187,28 +187,12 @@
 #define BW_AUTO_SWITCH_HIGH_LOW         25
 #define BW_AUTO_SWITCH_LOW_HIGH         30
 
-#define DM_DIG_THRESH_HIGH                      40
-#define DM_DIG_THRESH_LOW                       35
-
-#define DM_FALSEALARM_THRESH_LOW        400
-#define DM_FALSEALARM_THRESH_HIGH       1000
-
-#define DM_DIG_MAX                                      0x3e
-#define DM_DIG_MIN                                      0x1e
-
-#define DM_DIG_MAX_AP                           0x32
-#define DM_DIG_MIN_AP                           0x20
-
 #define DM_DIG_FA_UPPER                         0x3e
 #define DM_DIG_FA_LOWER                         0x1e
 #define DM_DIG_FA_TH0                           200
 #define DM_DIG_FA_TH1                           0x300
 #define DM_DIG_FA_TH2                           0x400
 
-#define DM_DIG_BACKOFF_MAX                      12
-#define DM_DIG_BACKOFF_MIN                      -4
-#define DM_DIG_BACKOFF_DEFAULT          10
-
 #define RXPATHSELECTION_SS_TH_LOW       30
 #define RXPATHSELECTION_DIFF_TH         18
 
@@ -262,14 +246,6 @@ enum tag_dynamic_init_gain_operation_type_definition {
         DIG_OP_TYPE_MAX
 };
 
-enum tag_cck_packet_detection_threshold_type_definition {
-        CCK_PD_STAGE_LOWRSSI = 0,
-        CCK_PD_STAGE_HIGHRSSI = 1,
-        CCK_FA_STAGE_LOW = 2,
-        CCK_FA_STAGE_HIGH = 3,
-        CCK_PD_STAGE_MAX = 4,
-};
-
 enum dm_1r_cca_e {
         CCA_1R = 0,
         CCA_2R = 1,
@@ -288,23 +264,6 @@ enum dm_sw_ant_switch_e {
         ANS_ANTENNA_MAX = 3,
 };
 
-enum dm_dig_ext_port_alg_e {
-        DIG_EXT_PORT_STAGE_0 = 0,
-        DIG_EXT_PORT_STAGE_1 = 1,
-        DIG_EXT_PORT_STAGE_2 = 2,
-        DIG_EXT_PORT_STAGE_3 = 3,
-        DIG_EXT_PORT_STAGE_MAX = 4,
-};
-
-enum dm_dig_connect_e {
-        DIG_STA_DISCONNECT = 0,
-        DIG_STA_CONNECT = 1,
-        DIG_STA_BEFORE_CONNECT = 2,
-        DIG_MULTISTA_DISCONNECT = 3,
-        DIG_MULTISTA_CONNECT = 4,
-        DIG_CONNECT_MAX
-};
-
 enum pwr_track_control_method {
         BBSWING,
         TXAGC,
diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/pwrseq.h b/drivers/net/wireless/rtlwifi/rtl8821ae/pwrseq.h
index bf0b0ce9519c..36b3e91d996e 100644
--- a/drivers/net/wireless/rtlwifi/rtl8821ae/pwrseq.h
+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/pwrseq.h
@@ -93,9 +93,9 @@
 
 #define RTL8812_TRANS_CARDEMU_TO_SUS                                    \
         {0x0042, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_USB_MSK,\
-        PWR_BASEADDR_MAC, PWR_CMD_WRITE, 0xF0, 0xcc}, \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, 0xF0, 0xc0}, \
         {0x0042, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_PCI_MSK,\
-        PWR_BASEADDR_MAC, PWR_CMD_WRITE, 0xF0, 0xEC}, \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, 0xF0, 0xE0}, \
         {0x0043, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,\
         PWR_BASEADDR_MAC, PWR_CMD_WRITE, 0xFF, 0x07 \
         /* gpio11 input mode, gpio10~8 output mode */}, \
diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c b/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c
index fc92dd6a0d07..a4988121e1ab 100644
--- a/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c
@@ -85,52 +85,6 @@ static void rtl8821ae_init_aspm_vars(struct ieee80211_hw *hw)
         rtlpci->const_support_pciaspm = 1;
 }
 
-static void load_wowlan_fw(struct rtl_priv *rtlpriv)
-{
-        /* callback routine to load wowlan firmware after main fw has
-         * been loaded
-         */
-        const struct firmware *wowlan_firmware;
-        char *fw_name = NULL;
-        int err;
-
-        /* for wowlan firmware buf */
-        rtlpriv->rtlhal.wowlan_firmware = vzalloc(0x8000);
-        if (!rtlpriv->rtlhal.wowlan_firmware) {
-                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
-                         "Can't alloc buffer for wowlan fw.\n");
-                return;
-        }
-
-        if (rtlpriv->rtlhal.hw_type == HARDWARE_TYPE_RTL8821AE)
-                fw_name = "rtlwifi/rtl8821aefw_wowlan.bin";
-        else
-                fw_name = "rtlwifi/rtl8812aefw_wowlan.bin";
-        err = request_firmware(&wowlan_firmware, fw_name, rtlpriv->io.dev);
-        if (err) {
-                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
-                         "Failed to request wowlan firmware!\n");
-                goto error;
-        }
-
-        if (wowlan_firmware->size > 0x8000) {
-                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
-                         "Wowlan Firmware is too big!\n");
-                goto error;
-        }
-
-        memcpy(rtlpriv->rtlhal.wowlan_firmware, wowlan_firmware->data,
-               wowlan_firmware->size);
-        rtlpriv->rtlhal.wowlan_fwsize = wowlan_firmware->size;
-        release_firmware(wowlan_firmware);
-
-        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "WOWLAN FirmwareDownload OK\n");
-        return;
-error:
-        release_firmware(wowlan_firmware);
-        vfree(rtlpriv->rtlhal.wowlan_firmware);
-}
-
 /*InitializeVariables8812E*/
 int rtl8821ae_init_sw_vars(struct ieee80211_hw *hw)
 {
@@ -231,7 +185,6 @@ int rtl8821ae_init_sw_vars(struct ieee80211_hw *hw)
         else if (rtlpriv->psc.reg_fwctrl_lps == 3)
                 rtlpriv->psc.fwctrl_psmode = FW_PS_DTIM_MODE;
 
-        rtlpriv->rtl_fw_second_cb = load_wowlan_fw;
         /* for firmware buf */
         rtlpriv->rtlhal.pfirmware = vzalloc(0x8000);
         if (!rtlpriv->rtlhal.pfirmware) {
@@ -239,20 +192,41 @@ int rtl8821ae_init_sw_vars(struct ieee80211_hw *hw)
                          "Can't alloc buffer for fw.\n");
                 return 1;
         }
+        rtlpriv->rtlhal.wowlan_firmware = vzalloc(0x8000);
+        if (!rtlpriv->rtlhal.wowlan_firmware) {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                         "Can't alloc buffer for wowlan fw.\n");
+                return 1;
+        }
 
-        if (rtlhal->hw_type == HARDWARE_TYPE_RTL8812AE)
+        if (rtlhal->hw_type == HARDWARE_TYPE_RTL8812AE) {
                 rtlpriv->cfg->fw_name = "rtlwifi/rtl8812aefw.bin";
-        else
+                rtlpriv->cfg->wowlan_fw_name = "rtlwifi/rtl8812aefw_wowlan.bin";
+        } else {
                 rtlpriv->cfg->fw_name = "rtlwifi/rtl8821aefw.bin";
+                rtlpriv->cfg->wowlan_fw_name = "rtlwifi/rtl8821aefw_wowlan.bin";
+        }
 
         rtlpriv->max_fw_size = 0x8000;
+        /*load normal firmware*/
         pr_info("Using firmware %s\n", rtlpriv->cfg->fw_name);
         err = request_firmware_nowait(THIS_MODULE, 1, rtlpriv->cfg->fw_name,
                                       rtlpriv->io.dev, GFP_KERNEL, hw,
                                       rtl_fw_cb);
         if (err) {
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
-                         "Failed to request firmware!\n");
+                         "Failed to request normal firmware!\n");
+                return 1;
+        }
+        /*load wowlan firmware*/
+        pr_info("Using firmware %s\n", rtlpriv->cfg->wowlan_fw_name);
+        err = request_firmware_nowait(THIS_MODULE, 1,
+                                      rtlpriv->cfg->wowlan_fw_name,
+                                      rtlpriv->io.dev, GFP_KERNEL, hw,
+                                      rtl_wowlan_fw_cb);
+        if (err) {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                         "Failed to request wowlan firmware!\n");
                 return 1;
         }
         return 0;
diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/trx.c b/drivers/net/wireless/rtlwifi/rtl8821ae/trx.c
index 383b86b05cba..72af4b9ee32b 100644
--- a/drivers/net/wireless/rtlwifi/rtl8821ae/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/trx.c
@@ -48,232 +48,6 @@ static u8 _rtl8821ae_map_hwqueue_to_fwqueue(struct sk_buff *skb, u8 hw_queue)
         return skb->priority;
 }
 
-/* mac80211's rate_idx is like this:
- *
- * 2.4G band:rx_status->band == IEEE80211_BAND_2GHZ
- *
- * B/G rate:
- * (rx_status->flag & RX_FLAG_HT) = 0,
- * DESC_RATE1M-->DESC_RATE54M ==> idx is 0-->11,
- *
- * N rate:
- * (rx_status->flag & RX_FLAG_HT) = 1,
- * DESC_RATEMCS0-->DESC_RATEMCS15 ==> idx is 0-->15
- *
- * 5G band:rx_status->band == IEEE80211_BAND_5GHZ
- * A rate:
- * (rx_status->flag & RX_FLAG_HT) = 0,
- * DESC_RATE6M-->DESC_RATE54M ==> idx is 0-->7,
- *
- * N rate:
- * (rx_status->flag & RX_FLAG_HT) = 1,
- * DESC_RATEMCS0-->DESC_RATEMCS15 ==> idx is 0-->15
- */
-static int _rtl8821ae_rate_mapping(struct ieee80211_hw *hw,
-                                   bool isht, bool isvht, u8 desc_rate)
-{
-        int rate_idx;
-
-        if (!isht) {
-                if (IEEE80211_BAND_2GHZ == hw->conf.chandef.chan->band) {
-                        switch (desc_rate) {
-                        case DESC_RATE1M:
-                                rate_idx = 0;
-                                break;
-                        case DESC_RATE2M:
-                                rate_idx = 1;
-                                break;
-                        case DESC_RATE5_5M:
-                                rate_idx = 2;
-                                break;
-                        case DESC_RATE11M:
-                                rate_idx = 3;
-                                break;
-                        case DESC_RATE6M:
-                                rate_idx = 4;
-                                break;
-                        case DESC_RATE9M:
-                                rate_idx = 5;
-                                break;
-                        case DESC_RATE12M:
-                                rate_idx = 6;
-                                break;
-                        case DESC_RATE18M:
-                                rate_idx = 7;
-                                break;
-                        case DESC_RATE24M:
-                                rate_idx = 8;
-                                break;
-                        case DESC_RATE36M:
-                                rate_idx = 9;
-                                break;
-                        case DESC_RATE48M:
-                                rate_idx = 10;
-                                break;
-                        case DESC_RATE54M:
-                                rate_idx = 11;
-                                break;
-                        default:
-                                rate_idx = 0;
-                                break;
-                        }
-                } else {
-                        switch (desc_rate) {
-                        case DESC_RATE6M:
-                                rate_idx = 0;
-                                break;
-                        case DESC_RATE9M:
-                                rate_idx = 1;
-                                break;
-                        case DESC_RATE12M:
-                                rate_idx = 2;
-                                break;
-                        case DESC_RATE18M:
-                                rate_idx = 3;
-                                break;
-                        case DESC_RATE24M:
-                                rate_idx = 4;
-                                break;
-                        case DESC_RATE36M:
-                                rate_idx = 5;
-                                break;
-                        case DESC_RATE48M:
-                                rate_idx = 6;
-                                break;
-                        case DESC_RATE54M:
-                                rate_idx = 7;
-                                break;
-                        default:
-                                rate_idx = 0;
-                                break;
-                        }
-                }
-        } else {
-                switch (desc_rate) {
-                case DESC_RATEMCS0:
-                        rate_idx = 0;
-                        break;
-                case DESC_RATEMCS1:
-                        rate_idx = 1;
-                        break;
-                case DESC_RATEMCS2:
-                        rate_idx = 2;
-                        break;
-                case DESC_RATEMCS3:
-                        rate_idx = 3;
-                        break;
-                case DESC_RATEMCS4:
-                        rate_idx = 4;
-                        break;
-                case DESC_RATEMCS5:
-                        rate_idx = 5;
-                        break;
-                case DESC_RATEMCS6:
-                        rate_idx = 6;
-                        break;
-                case DESC_RATEMCS7:
-                        rate_idx = 7;
-                        break;
-                case DESC_RATEMCS8:
-                        rate_idx = 8;
-                        break;
-                case DESC_RATEMCS9:
-                        rate_idx = 9;
-                        break;
-                case DESC_RATEMCS10:
-                        rate_idx = 10;
-                        break;
-                case DESC_RATEMCS11:
-                        rate_idx = 11;
-                        break;
-                case DESC_RATEMCS12:
-                        rate_idx = 12;
-                        break;
-                case DESC_RATEMCS13:
-                        rate_idx = 13;
-                        break;
-                case DESC_RATEMCS14:
-                        rate_idx = 14;
-                        break;
-                case DESC_RATEMCS15:
-                        rate_idx = 15;
-                        break;
-                default:
-                        rate_idx = 0;
-                        break;
-                }
-        }
-
-        if (isvht) {
-                switch (desc_rate) {
-                case DESC_RATEVHT1SS_MCS0:
-                        rate_idx = 0;
-                        break;
-                case DESC_RATEVHT1SS_MCS1:
-                        rate_idx = 1;
-                        break;
-                case DESC_RATEVHT1SS_MCS2:
-                        rate_idx = 2;
-                        break;
-                case DESC_RATEVHT1SS_MCS3:
-                        rate_idx = 3;
-                        break;
-                case DESC_RATEVHT1SS_MCS4:
-                        rate_idx = 4;
-                        break;
-                case DESC_RATEVHT1SS_MCS5:
-                        rate_idx = 5;
-                        break;
-                case DESC_RATEVHT1SS_MCS6:
-                        rate_idx = 6;
-                        break;
-                case DESC_RATEVHT1SS_MCS7:
-                        rate_idx = 7;
-                        break;
-                case DESC_RATEVHT1SS_MCS8:
-                        rate_idx = 8;
-                        break;
-                case DESC_RATEVHT1SS_MCS9:
-                        rate_idx = 9;
-                        break;
-                case DESC_RATEVHT2SS_MCS0:
-                        rate_idx = 0;
-                        break;
-                case DESC_RATEVHT2SS_MCS1:
-                        rate_idx = 1;
-                        break;
-                case DESC_RATEVHT2SS_MCS2:
-                        rate_idx = 2;
-                        break;
-                case DESC_RATEVHT2SS_MCS3:
-                        rate_idx = 3;
-                        break;
-                case DESC_RATEVHT2SS_MCS4:
-                        rate_idx = 4;
-                        break;
-                case DESC_RATEVHT2SS_MCS5:
-                        rate_idx = 5;
-                        break;
-                case DESC_RATEVHT2SS_MCS6:
-                        rate_idx = 6;
-                        break;
-                case DESC_RATEVHT2SS_MCS7:
-                        rate_idx = 7;
-                        break;
-                case DESC_RATEVHT2SS_MCS8:
-                        rate_idx = 8;
-                        break;
-                case DESC_RATEVHT2SS_MCS9:
-                        rate_idx = 9;
-                        break;
-                default:
-                        rate_idx = 0;
-                        break;
-                }
-        }
-        return rate_idx;
-}
-
 static u16 odm_cfo(char value)
 {
         int ret_val;
@@ -766,9 +540,9 @@ bool rtl8821ae_rx_query_desc(struct ieee80211_hw *hw,
          * supported rates or MCS index if HT rates
          * are use (RX_FLAG_HT)
          */
-        rx_status->rate_idx =
-          _rtl8821ae_rate_mapping(hw, status->is_ht,
-                                  status->is_vht, status->rate);
+        rx_status->rate_idx = rtlwifi_rate_mapping(hw, status->is_ht,
+                                                   status->is_vht,
+                                                   status->rate);
 
         rx_status->mactime = status->timestamp_low;
         if (phystatus) {
diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
index 6866dcf24340..51572912c53d 100644
--- a/drivers/net/wireless/rtlwifi/wifi.h
+++ b/drivers/net/wireless/rtlwifi/wifi.h
@@ -331,10 +331,10 @@ enum hardware_type {
 (IS_HARDWARE_TYPE_8723E(rtlhal) || IS_HARDWARE_TYPE_8723U(rtlhal))
 
 #define RX_HAL_IS_CCK_RATE(rxmcs)                       \
-        ((rxmcs) == DESC92_RATE1M ||                    \
-         (rxmcs) == DESC92_RATE2M ||                    \
-         (rxmcs) == DESC92_RATE5_5M ||                  \
-         (rxmcs) == DESC92_RATE11M)
+        ((rxmcs) == DESC_RATE1M ||                      \
+         (rxmcs) == DESC_RATE2M ||                      \
+         (rxmcs) == DESC_RATE5_5M ||                    \
+         (rxmcs) == DESC_RATE11M)
 
 enum scan_operation_backup_opt {
         SCAN_OPT_BACKUP = 0,
@@ -579,38 +579,59 @@ enum rtl_hal_state {
 };
 
 enum rtl_desc92_rate {
-        DESC92_RATE1M = 0x00,
-        DESC92_RATE2M = 0x01,
-        DESC92_RATE5_5M = 0x02,
-        DESC92_RATE11M = 0x03,
-
-        DESC92_RATE6M = 0x04,
-        DESC92_RATE9M = 0x05,
-        DESC92_RATE12M = 0x06,
-        DESC92_RATE18M = 0x07,
-        DESC92_RATE24M = 0x08,
-        DESC92_RATE36M = 0x09,
-        DESC92_RATE48M = 0x0a,
-        DESC92_RATE54M = 0x0b,
-
-        DESC92_RATEMCS0 = 0x0c,
-        DESC92_RATEMCS1 = 0x0d,
-        DESC92_RATEMCS2 = 0x0e,
-        DESC92_RATEMCS3 = 0x0f,
-        DESC92_RATEMCS4 = 0x10,
-        DESC92_RATEMCS5 = 0x11,
-        DESC92_RATEMCS6 = 0x12,
-        DESC92_RATEMCS7 = 0x13,
-        DESC92_RATEMCS8 = 0x14,
-        DESC92_RATEMCS9 = 0x15,
-        DESC92_RATEMCS10 = 0x16,
-        DESC92_RATEMCS11 = 0x17,
-        DESC92_RATEMCS12 = 0x18,
-        DESC92_RATEMCS13 = 0x19,
-        DESC92_RATEMCS14 = 0x1a,
-        DESC92_RATEMCS15 = 0x1b,
-        DESC92_RATEMCS15_SG = 0x1c,
-        DESC92_RATEMCS32 = 0x20,
+        DESC_RATE1M = 0x00,
+        DESC_RATE2M = 0x01,
+        DESC_RATE5_5M = 0x02,
+        DESC_RATE11M = 0x03,
+
+        DESC_RATE6M = 0x04,
+        DESC_RATE9M = 0x05,
+        DESC_RATE12M = 0x06,
+        DESC_RATE18M = 0x07,
+        DESC_RATE24M = 0x08,
+        DESC_RATE36M = 0x09,
+        DESC_RATE48M = 0x0a,
+        DESC_RATE54M = 0x0b,
+
+        DESC_RATEMCS0 = 0x0c,
+        DESC_RATEMCS1 = 0x0d,
+        DESC_RATEMCS2 = 0x0e,
+        DESC_RATEMCS3 = 0x0f,
+        DESC_RATEMCS4 = 0x10,
+        DESC_RATEMCS5 = 0x11,
+        DESC_RATEMCS6 = 0x12,
+        DESC_RATEMCS7 = 0x13,
+        DESC_RATEMCS8 = 0x14,
+        DESC_RATEMCS9 = 0x15,
+        DESC_RATEMCS10 = 0x16,
+        DESC_RATEMCS11 = 0x17,
+        DESC_RATEMCS12 = 0x18,
+        DESC_RATEMCS13 = 0x19,
+        DESC_RATEMCS14 = 0x1a,
+        DESC_RATEMCS15 = 0x1b,
+        DESC_RATEMCS15_SG = 0x1c,
+        DESC_RATEMCS32 = 0x20,
+
+        DESC_RATEVHT1SS_MCS0 = 0x2c,
+        DESC_RATEVHT1SS_MCS1 = 0x2d,
+        DESC_RATEVHT1SS_MCS2 = 0x2e,
+        DESC_RATEVHT1SS_MCS3 = 0x2f,
+        DESC_RATEVHT1SS_MCS4 = 0x30,
+        DESC_RATEVHT1SS_MCS5 = 0x31,
+        DESC_RATEVHT1SS_MCS6 = 0x32,
+        DESC_RATEVHT1SS_MCS7 = 0x33,
+        DESC_RATEVHT1SS_MCS8 = 0x34,
+        DESC_RATEVHT1SS_MCS9 = 0x35,
+        DESC_RATEVHT2SS_MCS0 = 0x36,
+        DESC_RATEVHT2SS_MCS1 = 0x37,
+        DESC_RATEVHT2SS_MCS2 = 0x38,
+        DESC_RATEVHT2SS_MCS3 = 0x39,
+        DESC_RATEVHT2SS_MCS4 = 0x3a,
+        DESC_RATEVHT2SS_MCS5 = 0x3b,
+        DESC_RATEVHT2SS_MCS6 = 0x3c,
+        DESC_RATEVHT2SS_MCS7 = 0x3d,
+        DESC_RATEVHT2SS_MCS8 = 0x3e,
+        DESC_RATEVHT2SS_MCS9 = 0x3f,
 };
 
 enum rtl_var_map {
@@ -2161,6 +2182,7 @@ struct rtl_hal_ops {
         void (*add_wowlan_pattern)(struct ieee80211_hw *hw,
                                    struct rtl_wow_pattern *rtl_pattern,
                                    u8 index);
+        u16 (*get_available_desc)(struct ieee80211_hw *hw, u8 q_idx);
 };
 
 struct rtl_intf_ops {
@@ -2242,6 +2264,7 @@ struct rtl_hal_cfg {
         char *name;
         char *fw_name;
         char *alt_fw_name;
+        char *wowlan_fw_name;
         struct rtl_hal_ops *ops;
         struct rtl_mod_params *mod_params;
         struct rtl_hal_usbint_cfg *usb_interface_cfg;
@@ -2390,8 +2413,6 @@ struct dig_t {
         u8 pre_ccastate;
         u8 cur_ccasate;
         u8 large_fa_hit;
-        u8 dig_dynamic_min;
-        u8 dig_dynamic_min_1;
         u8 forbidden_igi;
         u8 dig_state;
         u8 dig_highpwrstate;
@@ -2518,8 +2539,6 @@ struct proxim {
 
 struct rtl_priv {
         struct ieee80211_hw *hw;
-        /* Used to load a second firmware */
-        void (*rtl_fw_second_cb)(struct rtl_priv *rtlpriv);
         struct completion firmware_loading_complete;
         struct list_head list;
         struct rtl_priv *buddy_priv;
diff --git a/drivers/net/wireless/ti/wl1251/main.c b/drivers/net/wireless/ti/wl1251/main.c
index 0b30a7b4d663..d4ba009ac9aa 100644
--- a/drivers/net/wireless/ti/wl1251/main.c
+++ b/drivers/net/wireless/ti/wl1251/main.c
@@ -500,6 +500,7 @@ static int wl1251_op_add_interface(struct ieee80211_hw *hw,
         int ret = 0;
 
         vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER |
+                             IEEE80211_VIF_SUPPORTS_UAPSD |
                              IEEE80211_VIF_SUPPORTS_CQM_RSSI;
 
         wl1251_debug(DEBUG_MAC80211, "mac80211 add interface type %d mac %pM",
@@ -1480,9 +1481,7 @@ int wl1251_init_ieee80211(struct wl1251 *wl)
         /* unit us */
         /* FIXME: find a proper value */
 
-        wl->hw->flags = IEEE80211_HW_SIGNAL_DBM |
-                IEEE80211_HW_SUPPORTS_PS |
-                IEEE80211_HW_SUPPORTS_UAPSD;
+        wl->hw->flags = IEEE80211_HW_SIGNAL_DBM | IEEE80211_HW_SUPPORTS_PS;
 
         wl->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
                                          BIT(NL80211_IFTYPE_ADHOC);
diff --git a/drivers/net/wireless/ti/wl12xx/main.c b/drivers/net/wireless/ti/wl12xx/main.c
index d6d0d6d9c7a8..144d1f8ba473 100644
--- a/drivers/net/wireless/ti/wl12xx/main.c
+++ b/drivers/net/wireless/ti/wl12xx/main.c
@@ -250,6 +250,7 @@ static struct wlcore_conf wl12xx_conf = {
                 .keep_alive_interval         = 55000,
                 .max_listen_interval         = 20,
                 .sta_sleep_auth              = WL1271_PSM_ILLEGAL,
+                .suspend_rx_ba_activity      = 0,
         },
         .itrim = {
                 .enable = false,
@@ -1728,6 +1729,9 @@ static struct wlcore_ops wl12xx_ops = {
         .convert_hwaddr         = wl12xx_convert_hwaddr,
         .lnk_high_prio          = wl12xx_lnk_high_prio,
         .lnk_low_prio           = wl12xx_lnk_low_prio,
+        .interrupt_notify       = NULL,
+        .rx_ba_filter           = NULL,
+        .ap_sleep               = NULL,
 };
 
 static struct ieee80211_sta_ht_cap wl12xx_ht_cap = {
diff --git a/drivers/net/wireless/ti/wl18xx/acx.c b/drivers/net/wireless/ti/wl18xx/acx.c
index a169bb5a5dbf..67f2a0eec854 100644
--- a/drivers/net/wireless/ti/wl18xx/acx.c
+++ b/drivers/net/wireless/ti/wl18xx/acx.c
@@ -24,6 +24,7 @@
 #include "../wlcore/acx.h"
 
 #include "acx.h"
+#include "wl18xx.h"
 
 int wl18xx_acx_host_if_cfg_bitmap(struct wl1271 *wl, u32 host_cfg_bitmap,
                                   u32 sdio_blk_size, u32 extra_mem_blks,
@@ -194,3 +195,90 @@ out:
         kfree(acx);
         return ret;
 }
+
+/*
+ * When the host is suspended, we don't want to get any fast-link/PSM
+ * notifications
+ */
+int wl18xx_acx_interrupt_notify_config(struct wl1271 *wl,
+                                       bool action)
+{
+        struct wl18xx_acx_interrupt_notify *acx;
+        int ret = 0;
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->enable = action;
+        ret = wl1271_cmd_configure(wl, ACX_INTERRUPT_NOTIFY, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("acx interrupt notify setting failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
+/*
+ * When the host is suspended, we can configure the FW to disable RX BA
+ * notifications.
+ */
+int wl18xx_acx_rx_ba_filter(struct wl1271 *wl, bool action)
+{
+        struct wl18xx_acx_rx_ba_filter *acx;
+        int ret = 0;
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->enable = (u32)action;
+        ret = wl1271_cmd_configure(wl, ACX_RX_BA_FILTER, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("acx rx ba activity filter setting failed: %d",
+                               ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
+int wl18xx_acx_ap_sleep(struct wl1271 *wl)
+{
+        struct wl18xx_priv *priv = wl->priv;
+        struct acx_ap_sleep_cfg *acx;
+        struct conf_ap_sleep_settings *conf = &priv->conf.ap_sleep;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx config ap sleep");
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->idle_duty_cycle = conf->idle_duty_cycle;
+        acx->connected_duty_cycle = conf->connected_duty_cycle;
+        acx->max_stations_thresh = conf->max_stations_thresh;
+        acx->idle_conn_thresh = conf->idle_conn_thresh;
+
+        ret = wl1271_cmd_configure(wl, ACX_AP_SLEEP_CFG, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("acx config ap-sleep failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
diff --git a/drivers/net/wireless/ti/wl18xx/acx.h b/drivers/net/wireless/ti/wl18xx/acx.h
index 0e636def1217..4afccd4b9467 100644
--- a/drivers/net/wireless/ti/wl18xx/acx.h
+++ b/drivers/net/wireless/ti/wl18xx/acx.h
@@ -32,7 +32,10 @@ enum {
         ACX_SIM_CONFIG                   = 0x0053,
         ACX_CLEAR_STATISTICS             = 0x0054,
         ACX_AUTO_RX_STREAMING            = 0x0055,
-        ACX_PEER_CAP                     = 0x0056
+        ACX_PEER_CAP                     = 0x0056,
+        ACX_INTERRUPT_NOTIFY             = 0x0057,
+        ACX_RX_BA_FILTER                 = 0x0058,
+        ACX_AP_SLEEP_CFG                 = 0x0059
 };
 
 /* numbers of bits the length field takes (add 1 for the actual number) */
@@ -326,6 +329,44 @@ struct wlcore_acx_peer_cap {
         u8 padding;
 } __packed;
 
+/*
+ * ACX_INTERRUPT_NOTIFY
+ * enable/disable fast-link/PSM notification from FW
+ */
+struct wl18xx_acx_interrupt_notify {
+        struct acx_header header;
+        u32 enable;
+};
+
+/*
+ * ACX_RX_BA_FILTER
+ * enable/disable RX BA filtering in FW
+ */
+struct wl18xx_acx_rx_ba_filter {
+        struct acx_header header;
+        u32 enable;
+};
+
+struct acx_ap_sleep_cfg {
+        struct acx_header header;
+        /* Duty Cycle (20-80% of staying Awake) for IDLE AP
+         * (0: disable)
+         */
+        u8 idle_duty_cycle;
+        /* Duty Cycle (20-80% of staying Awake) for Connected AP
+         * (0: disable)
+         */
+        u8 connected_duty_cycle;
+        /* Maximum stations that are allowed to be connected to AP
+         *  (255: no limit)
+         */
+        u8 max_stations_thresh;
+        /* Timeout till enabling the Sleep Mechanism after data stops
+         * [unit: 100 msec]
+         */
+        u8 idle_conn_thresh;
+} __packed;
+
 int wl18xx_acx_host_if_cfg_bitmap(struct wl1271 *wl, u32 host_cfg_bitmap,
                                   u32 sdio_blk_size, u32 extra_mem_blks,
                                   u32 len_field_size);
@@ -336,5 +377,8 @@ int wl18xx_acx_set_peer_cap(struct wl1271 *wl,
                             struct ieee80211_sta_ht_cap *ht_cap,
                             bool allow_ht_operation,
                             u32 rate_set, u8 hlid);
+int wl18xx_acx_interrupt_notify_config(struct wl1271 *wl, bool action);
+int wl18xx_acx_rx_ba_filter(struct wl1271 *wl, bool action);
+int wl18xx_acx_ap_sleep(struct wl1271 *wl);
 
 #endif /* __WL18XX_ACX_H__ */
diff --git a/drivers/net/wireless/ti/wl18xx/cmd.c b/drivers/net/wireless/ti/wl18xx/cmd.c
index 44f0b205b065..a8d176ddc73c 100644
--- a/drivers/net/wireless/ti/wl18xx/cmd.c
+++ b/drivers/net/wireless/ti/wl18xx/cmd.c
@@ -33,7 +33,8 @@ int wl18xx_cmd_channel_switch(struct wl1271 *wl,
         u32 supported_rates;
         int ret;
 
-        wl1271_debug(DEBUG_ACX, "cmd channel switch");
+        wl1271_debug(DEBUG_ACX, "cmd channel switch (count=%d)",
+                     ch_switch->count);
 
         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
         if (!cmd) {
@@ -60,8 +61,12 @@ int wl18xx_cmd_channel_switch(struct wl1271 *wl,
                 goto out_free;
         }
 
-        supported_rates = CONF_TX_ENABLED_RATES | CONF_TX_MCS_RATES |
-                          wlcore_hw_sta_get_ap_rate_mask(wl, wlvif);
+        supported_rates = CONF_TX_ENABLED_RATES | CONF_TX_MCS_RATES;
+        if (wlvif->bss_type == BSS_TYPE_STA_BSS)
+                supported_rates |= wlcore_hw_sta_get_ap_rate_mask(wl, wlvif);
+        else
+                supported_rates |=
+                        wlcore_hw_ap_get_mimo_wide_rate_mask(wl, wlvif);
         if (wlvif->p2p)
                 supported_rates &= ~CONF_TX_CCK_RATES;
         cmd->local_supported_rates = cpu_to_le32(supported_rates);
@@ -167,3 +172,85 @@ out_free:
 out:
         return ret;
 }
+
+int wl18xx_cmd_set_cac(struct wl1271 *wl, struct wl12xx_vif *wlvif, bool start)
+{
+        struct wlcore_cmd_cac_start *cmd;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_CMD, "cmd cac (channel %d) %s",
+                     wlvif->channel, start ? "start" : "stop");
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd)
+                return -ENOMEM;
+
+        cmd->role_id = wlvif->role_id;
+        cmd->channel = wlvif->channel;
+        if (wlvif->band == IEEE80211_BAND_5GHZ)
+                cmd->band = WLCORE_BAND_5GHZ;
+        cmd->bandwidth = wlcore_get_native_channel_type(wlvif->channel_type);
+
+        ret = wl1271_cmd_send(wl,
+                              start ? CMD_CAC_START : CMD_CAC_STOP,
+                              cmd, sizeof(*cmd), 0);
+        if (ret < 0) {
+                wl1271_error("failed to send cac command");
+                goto out_free;
+        }
+
+out_free:
+        kfree(cmd);
+        return ret;
+}
+
+int wl18xx_cmd_radar_detection_debug(struct wl1271 *wl, u8 channel)
+{
+        struct wl18xx_cmd_dfs_radar_debug *cmd;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_CMD, "cmd radar detection debug (chan %d)",
+                     channel);
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd)
+                return -ENOMEM;
+
+        cmd->channel = channel;
+
+        ret = wl1271_cmd_send(wl, CMD_DFS_RADAR_DETECTION_DEBUG,
+                              cmd, sizeof(*cmd), 0);
+        if (ret < 0) {
+                wl1271_error("failed to send radar detection debug command");
+                goto out_free;
+        }
+
+out_free:
+        kfree(cmd);
+        return ret;
+}
+
+int wl18xx_cmd_dfs_master_restart(struct wl1271 *wl, struct wl12xx_vif *wlvif)
+{
+        struct wl18xx_cmd_dfs_master_restart *cmd;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_CMD, "cmd dfs master restart (role %d)",
+                     wlvif->role_id);
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd)
+                return -ENOMEM;
+
+        cmd->role_id = wlvif->role_id;
+
+        ret = wl1271_cmd_send(wl, CMD_DFS_MASTER_RESTART,
+                              cmd, sizeof(*cmd), 0);
+        if (ret < 0) {
+                wl1271_error("failed to send dfs master restart command");
+                goto out_free;
+        }
+out_free:
+        kfree(cmd);
+        return ret;
+}
diff --git a/drivers/net/wireless/ti/wl18xx/cmd.h b/drivers/net/wireless/ti/wl18xx/cmd.h
index 92499e2dfa83..7f9440a2bff8 100644
--- a/drivers/net/wireless/ti/wl18xx/cmd.h
+++ b/drivers/net/wireless/ti/wl18xx/cmd.h
@@ -59,6 +59,30 @@ struct wl18xx_cmd_smart_config_set_group_key {
         u8 key[16];
 } __packed;
 
+struct wl18xx_cmd_dfs_radar_debug {
+        struct wl1271_cmd_header header;
+
+        u8 channel;
+        u8 padding[3];
+} __packed;
+
+struct wl18xx_cmd_dfs_master_restart {
+        struct wl1271_cmd_header header;
+
+        u8 role_id;
+        u8 padding[3];
+} __packed;
+
+/* cac_start and cac_stop share the same params */
+struct wlcore_cmd_cac_start {
+        struct wl1271_cmd_header header;
+
+        u8 role_id;
+        u8 channel;
+        u8 band;
+        u8 bandwidth;
+} __packed;
+
 int wl18xx_cmd_channel_switch(struct wl1271 *wl,
                               struct wl12xx_vif *wlvif,
                               struct ieee80211_channel_switch *ch_switch);
@@ -66,4 +90,7 @@ int wl18xx_cmd_smart_config_start(struct wl1271 *wl, u32 group_bitmap);
 int wl18xx_cmd_smart_config_stop(struct wl1271 *wl);
 int wl18xx_cmd_smart_config_set_group_key(struct wl1271 *wl, u16 group_id,
                                           u8 key_len, u8 *key);
+int wl18xx_cmd_set_cac(struct wl1271 *wl, struct wl12xx_vif *wlvif, bool start);
+int wl18xx_cmd_radar_detection_debug(struct wl1271 *wl, u8 channel);
+int wl18xx_cmd_dfs_master_restart(struct wl1271 *wl, struct wl12xx_vif *wlvif);
 #endif
diff --git a/drivers/net/wireless/ti/wl18xx/conf.h b/drivers/net/wireless/ti/wl18xx/conf.h
index e34302e3b51d..71f1ec448ba5 100644
--- a/drivers/net/wireless/ti/wl18xx/conf.h
+++ b/drivers/net/wireless/ti/wl18xx/conf.h
@@ -23,7 +23,7 @@
 #define __WL18XX_CONF_H__
 
 #define WL18XX_CONF_MAGIC       0x10e100ca
-#define WL18XX_CONF_VERSION     (WLCORE_CONF_VERSION | 0x0006)
+#define WL18XX_CONF_VERSION     (WLCORE_CONF_VERSION | 0x0007)
 #define WL18XX_CONF_MASK        0x0000ffff
 #define WL18XX_CONF_SIZE        (WLCORE_CONF_SIZE + \
                                  sizeof(struct wl18xx_priv_conf))
@@ -110,12 +110,33 @@ struct wl18xx_ht_settings {
         u8 mode;
 } __packed;
 
+struct conf_ap_sleep_settings {
+        /* Duty Cycle (20-80% of staying Awake) for IDLE AP
+         * (0: disable)
+         */
+        u8 idle_duty_cycle;
+        /* Duty Cycle (20-80% of staying Awake) for Connected AP
+         * (0: disable)
+         */
+        u8 connected_duty_cycle;
+        /* Maximum stations that are allowed to be connected to AP
+         *  (255: no limit)
+         */
+        u8 max_stations_thresh;
+        /* Timeout till enabling the Sleep Mechanism after data stops
+         * [unit: 100 msec]
+         */
+        u8 idle_conn_thresh;
+} __packed;
+
 struct wl18xx_priv_conf {
         /* Module params structures */
         struct wl18xx_ht_settings ht;
 
         /* this structure is copied wholesale to FW */
         struct wl18xx_mac_and_phy_params phy;
+
+        struct conf_ap_sleep_settings ap_sleep;
 } __packed;
 
 #endif /* __WL18XX_CONF_H__ */
diff --git a/drivers/net/wireless/ti/wl18xx/debugfs.c b/drivers/net/wireless/ti/wl18xx/debugfs.c
index 7f1669cdea09..c93fae95baac 100644
--- a/drivers/net/wireless/ti/wl18xx/debugfs.c
+++ b/drivers/net/wireless/ti/wl18xx/debugfs.c
@@ -22,9 +22,12 @@
 
 #include "../wlcore/debugfs.h"
 #include "../wlcore/wlcore.h"
+#include "../wlcore/debug.h"
+#include "../wlcore/ps.h"
 
 #include "wl18xx.h"
 #include "acx.h"
+#include "cmd.h"
 #include "debugfs.h"
 
 #define WL18XX_DEBUGFS_FWSTATS_FILE(a, b, c) \
@@ -239,6 +242,45 @@ static const struct file_operations clear_fw_stats_ops = {
         .llseek = default_llseek,
 };
 
+static ssize_t radar_detection_write(struct file *file,
+                                     const char __user *user_buf,
+                                     size_t count, loff_t *ppos)
+{
+        struct wl1271 *wl = file->private_data;
+        int ret;
+        u8 channel;
+
+        ret = kstrtou8_from_user(user_buf, count, 10, &channel);
+        if (ret < 0) {
+                wl1271_warning("illegal channel");
+                return -EINVAL;
+        }
+
+        mutex_lock(&wl->mutex);
+
+        if (unlikely(wl->state != WLCORE_STATE_ON))
+                goto out;
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
+        ret = wl18xx_cmd_radar_detection_debug(wl, channel);
+        if (ret < 0)
+                count = ret;
+
+        wl1271_ps_elp_sleep(wl);
+out:
+        mutex_unlock(&wl->mutex);
+        return count;
+}
+
+static const struct file_operations radar_detection_ops = {
+        .write = radar_detection_write,
+        .open = simple_open,
+        .llseek = default_llseek,
+};
+
 int wl18xx_debugfs_add_files(struct wl1271 *wl,
                              struct dentry *rootdir)
 {
@@ -390,6 +432,7 @@ int wl18xx_debugfs_add_files(struct wl1271 *wl,
         DEBUGFS_FWSTATS_ADD(mem, fw_gen_free_mem_blks);
 
         DEBUGFS_ADD(conf, moddir);
+        DEBUGFS_ADD(radar_detection, moddir);
 
         return 0;
 
diff --git a/drivers/net/wireless/ti/wl18xx/event.c b/drivers/net/wireless/ti/wl18xx/event.c
index eb1848e08424..c28f06854195 100644
--- a/drivers/net/wireless/ti/wl18xx/event.c
+++ b/drivers/net/wireless/ti/wl18xx/event.c
@@ -47,6 +47,19 @@ int wl18xx_wait_for_event(struct wl1271 *wl, enum wlcore_wait_event event,
         return wlcore_cmd_wait_for_event_or_timeout(wl, local_event, timeout);
 }
 
+static const char *wl18xx_radar_type_decode(u8 radar_type)
+{
+        switch (radar_type) {
+        case RADAR_TYPE_REGULAR:
+                return "REGULAR";
+        case RADAR_TYPE_CHIRP:
+                return "CHIRP";
+        case RADAR_TYPE_NONE:
+        default:
+                return "N/A";
+        }
+}
+
 static int wlcore_smart_config_sync_event(struct wl1271 *wl, u8 sync_channel,
                                           u8 sync_band)
 {
@@ -115,6 +128,14 @@ int wl18xx_process_mailbox_events(struct wl1271 *wl)
                         wl18xx_scan_completed(wl, wl->scan_wlvif);
         }
 
+        if (vector & RADAR_DETECTED_EVENT_ID) {
+                wl1271_info("radar event: channel %d type %s",
+                            mbox->radar_channel,
+                            wl18xx_radar_type_decode(mbox->radar_type));
+
+                ieee80211_radar_detected(wl->hw);
+        }
+
         if (vector & PERIODIC_SCAN_REPORT_EVENT_ID) {
                 wl1271_debug(DEBUG_EVENT,
                              "PERIODIC_SCAN_REPORT_EVENT (results %d)",
diff --git a/drivers/net/wireless/ti/wl18xx/event.h b/drivers/net/wireless/ti/wl18xx/event.h
index 0680312d4943..266ee87834e4 100644
--- a/drivers/net/wireless/ti/wl18xx/event.h
+++ b/drivers/net/wireless/ti/wl18xx/event.h
@@ -42,6 +42,12 @@ enum {
         SMART_CONFIG_DECODE_EVENT_ID             = BIT(23),
 };
 
+enum wl18xx_radar_types {
+        RADAR_TYPE_NONE,
+        RADAR_TYPE_REGULAR,
+        RADAR_TYPE_CHIRP
+};
+
 struct wl18xx_event_mailbox {
         __le32 events_vector;
 
@@ -83,13 +89,19 @@ struct wl18xx_event_mailbox {
         u8 sc_token_len;
         u8 padding1;
         u8 sc_ssid[32];
-        u8 sc_pwd[32];
+        u8 sc_pwd[64];
         u8 sc_token[32];
 
         /* smart config sync channel */
         u8 sc_sync_channel;
         u8 sc_sync_band;
         u8 padding2[2];
+
+        /* radar detect */
+        u8 radar_channel;
+        u8 radar_type;
+
+        u8 padding3[2];
 } __packed;
 
 int wl18xx_wait_for_event(struct wl1271 *wl, enum wlcore_wait_event event,
diff --git a/drivers/net/wireless/ti/wl18xx/main.c b/drivers/net/wireless/ti/wl18xx/main.c
index 8e562610bf16..717c4f5a02c2 100644
--- a/drivers/net/wireless/ti/wl18xx/main.c
+++ b/drivers/net/wireless/ti/wl18xx/main.c
@@ -378,6 +378,7 @@ static struct wlcore_conf wl18xx_conf = {
                 .keep_alive_interval         = 55000,
                 .max_listen_interval         = 20,
                 .sta_sleep_auth              = WL1271_PSM_ILLEGAL,
+                .suspend_rx_ba_activity      = 0,
         },
         .itrim = {
                 .enable = false,
@@ -567,6 +568,12 @@ static struct wl18xx_priv_conf wl18xx_default_priv_conf = {
                 .high_power_val_2nd             = 0xff,
                 .tx_rf_margin                   = 1,
         },
+        .ap_sleep = {               /* disabled by default */
+                .idle_duty_cycle        = 0,
+                .connected_duty_cycle   = 0,
+                .max_stations_thresh    = 0,
+                .idle_conn_thresh       = 0,
+        },
 };
 
 static const struct wlcore_partition_set wl18xx_ptable[PART_TABLE_LEN] = {
@@ -648,7 +655,7 @@ static const struct wl18xx_clk_cfg wl18xx_clk_table[NUM_CLOCK_CONFIGS] = {
 };
 
 /* TODO: maybe move to a new header file? */
-#define WL18XX_FW_NAME "ti-connectivity/wl18xx-fw-3.bin"
+#define WL18XX_FW_NAME "ti-connectivity/wl18xx-fw-4.bin"
 
 static int wl18xx_identify_chip(struct wl1271 *wl)
 {
@@ -983,6 +990,7 @@ static int wl18xx_boot(struct wl1271 *wl)
 
         wl->event_mask = BSS_LOSS_EVENT_ID |
                 SCAN_COMPLETE_EVENT_ID |
+                RADAR_DETECTED_EVENT_ID |
                 RSSI_SNR_TRIGGER_0_EVENT_ID |
                 PERIODIC_SCAN_COMPLETE_EVENT_ID |
                 PERIODIC_SCAN_REPORT_EVENT_ID |
@@ -1559,26 +1567,19 @@ static u32 wl18xx_pre_pkt_send(struct wl1271 *wl,
 }
 
 static void wl18xx_sta_rc_update(struct wl1271 *wl,
-                                 struct wl12xx_vif *wlvif,
-                                 struct ieee80211_sta *sta,
-                                 u32 changed)
+                                 struct wl12xx_vif *wlvif)
 {
-        bool wide = sta->bandwidth >= IEEE80211_STA_RX_BW_40;
+        bool wide = wlvif->rc_update_bw >= IEEE80211_STA_RX_BW_40;
 
         wl1271_debug(DEBUG_MAC80211, "mac80211 sta_rc_update wide %d", wide);
 
-        if (!(changed & IEEE80211_RC_BW_CHANGED))
-                return;
-
-        mutex_lock(&wl->mutex);
-
         /* sanity */
         if (WARN_ON(wlvif->bss_type != BSS_TYPE_STA_BSS))
-                goto out;
+                return;
 
         /* ignore the change before association */
         if (!test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags))
-                goto out;
+                return;
 
         /*
          * If we started out as wide, we can change the operation mode. If we
@@ -1589,9 +1590,6 @@ static void wl18xx_sta_rc_update(struct wl1271 *wl,
                 wl18xx_acx_peer_ht_operation_mode(wl, wlvif->sta.hlid, wide);
         else
                 ieee80211_connection_loss(wl12xx_wlvif_to_vif(wlvif));
-
-out:
-        mutex_unlock(&wl->mutex);
 }
 
 static int wl18xx_set_peer_cap(struct wl1271 *wl,
@@ -1703,6 +1701,11 @@ static struct wlcore_ops wl18xx_ops = {
         .smart_config_start = wl18xx_cmd_smart_config_start,
         .smart_config_stop  = wl18xx_cmd_smart_config_stop,
         .smart_config_set_group_key = wl18xx_cmd_smart_config_set_group_key,
+        .interrupt_notify = wl18xx_acx_interrupt_notify_config,
+        .rx_ba_filter   = wl18xx_acx_rx_ba_filter,
+        .ap_sleep       = wl18xx_acx_ap_sleep,
+        .set_cac        = wl18xx_cmd_set_cac,
+        .dfs_master_restart     = wl18xx_cmd_dfs_master_restart,
 };
 
 /* HT cap appropriate for wide channels in 2Ghz */
@@ -1796,6 +1799,10 @@ wl18xx_iface_combinations[] = {
                 .limits = wl18xx_iface_ap_limits,
                 .n_limits = ARRAY_SIZE(wl18xx_iface_ap_limits),
                 .num_different_channels = 1,
+                .radar_detect_widths =  BIT(NL80211_CHAN_NO_HT) |
+                                        BIT(NL80211_CHAN_HT20) |
+                                        BIT(NL80211_CHAN_HT40MINUS) |
+                                        BIT(NL80211_CHAN_HT40PLUS),
         }
 };
 
diff --git a/drivers/net/wireless/ti/wl18xx/wl18xx.h b/drivers/net/wireless/ti/wl18xx/wl18xx.h
index 6a2b88030c1d..71e9e382ce80 100644
--- a/drivers/net/wireless/ti/wl18xx/wl18xx.h
+++ b/drivers/net/wireless/ti/wl18xx/wl18xx.h
@@ -26,10 +26,10 @@
 
 /* minimum FW required for driver */
 #define WL18XX_CHIP_VER         8
-#define WL18XX_IFTYPE_VER       8
+#define WL18XX_IFTYPE_VER       9
 #define WL18XX_MAJOR_VER        WLCORE_FW_VER_IGNORE
 #define WL18XX_SUBTYPE_VER      WLCORE_FW_VER_IGNORE
-#define WL18XX_MINOR_VER        13
+#define WL18XX_MINOR_VER        11
 
 #define WL18XX_CMD_MAX_SIZE          740
 
diff --git a/drivers/net/wireless/ti/wlcore/acx.c b/drivers/net/wireless/ti/wlcore/acx.c
index b924ceadc02c..f28fa3b5029d 100644
--- a/drivers/net/wireless/ti/wlcore/acx.c
+++ b/drivers/net/wireless/ti/wlcore/acx.c
@@ -1725,7 +1725,7 @@ int wl12xx_acx_config_hangover(struct wl1271 *wl)
         acx->decrease_delta = conf->decrease_delta;
         acx->quiet_time = conf->quiet_time;
         acx->increase_time = conf->increase_time;
-        acx->window_size = acx->window_size;
+        acx->window_size = conf->window_size;
 
         ret = wl1271_cmd_configure(wl, ACX_CONFIG_HANGOVER, acx,
                                    sizeof(*acx));
diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c
index b82661962d33..c26fc2106e5b 100644
--- a/drivers/net/wireless/ti/wlcore/cmd.c
+++ b/drivers/net/wireless/ti/wlcore/cmd.c
@@ -403,7 +403,7 @@ void wl12xx_free_link(struct wl1271 *wl, struct wl12xx_vif *wlvif, u8 *hlid)
         WARN_ON_ONCE(wl->active_link_count < 0);
 }
 
-static u8 wlcore_get_native_channel_type(u8 nl_channel_type)
+u8 wlcore_get_native_channel_type(u8 nl_channel_type)
 {
         switch (nl_channel_type) {
         case NL80211_CHAN_NO_HT:
@@ -419,6 +419,7 @@ static u8 wlcore_get_native_channel_type(u8 nl_channel_type)
                 return WLCORE_CHAN_NO_HT;
         }
 }
+EXPORT_SYMBOL_GPL(wlcore_get_native_channel_type);
 
 static int wl12xx_cmd_role_start_dev(struct wl1271 *wl,
                                      struct wl12xx_vif *wlvif,
@@ -1686,9 +1687,7 @@ int wlcore_cmd_regdomain_config_locked(struct wl1271 *wl)
 {
         struct wl12xx_cmd_regdomain_dfs_config *cmd = NULL;
         int ret = 0, i, b, ch_bit_idx;
-        struct ieee80211_channel *channel;
         u32 tmp_ch_bitmap[2];
-        u16 ch;
         struct wiphy *wiphy = wl->hw->wiphy;
         struct ieee80211_supported_band *band;
         bool timeout = false;
@@ -1703,12 +1702,16 @@ int wlcore_cmd_regdomain_config_locked(struct wl1271 *wl)
         for (b = IEEE80211_BAND_2GHZ; b <= IEEE80211_BAND_5GHZ; b++) {
                 band = wiphy->bands[b];
                 for (i = 0; i < band->n_channels; i++) {
-                        channel = &band->channels[i];
-                        ch = channel->hw_value;
+                        struct ieee80211_channel *channel = &band->channels[i];
+                        u16 ch = channel->hw_value;
+                        u32 flags = channel->flags;
 
-                        if (channel->flags & (IEEE80211_CHAN_DISABLED |
-                                              IEEE80211_CHAN_RADAR |
-                                              IEEE80211_CHAN_NO_IR))
+                        if (flags & (IEEE80211_CHAN_DISABLED |
+                                     IEEE80211_CHAN_NO_IR))
+                                continue;
+
+                        if ((flags & IEEE80211_CHAN_RADAR) &&
+                            channel->dfs_state != NL80211_DFS_AVAILABLE)
                                 continue;
 
                         ch_bit_idx = wlcore_get_reg_conf_ch_idx(b, ch);
@@ -1733,6 +1736,7 @@ int wlcore_cmd_regdomain_config_locked(struct wl1271 *wl)
 
         cmd->ch_bit_map1 = cpu_to_le32(tmp_ch_bitmap[0]);
         cmd->ch_bit_map2 = cpu_to_le32(tmp_ch_bitmap[1]);
+        cmd->dfs_region = wl->dfs_region;
 
         wl1271_debug(DEBUG_CMD,
                      "cmd reg domain bitmap1: 0x%08x, bitmap2: 0x%08x",
diff --git a/drivers/net/wireless/ti/wlcore/cmd.h b/drivers/net/wireless/ti/wlcore/cmd.h
index 453684a71d30..e14cd407a6ae 100644
--- a/drivers/net/wireless/ti/wlcore/cmd.h
+++ b/drivers/net/wireless/ti/wlcore/cmd.h
@@ -105,6 +105,7 @@ int wl12xx_allocate_link(struct wl1271 *wl, struct wl12xx_vif *wlvif,
 void wl12xx_free_link(struct wl1271 *wl, struct wl12xx_vif *wlvif, u8 *hlid);
 int wlcore_cmd_wait_for_event_or_timeout(struct wl1271 *wl,
                                          u32 mask, bool *timeout);
+u8 wlcore_get_native_channel_type(u8 nl_channel_type);
 
 enum wl1271_commands {
         CMD_INTERROGATE = 1, /* use this to read information elements */
@@ -172,6 +173,11 @@ enum wl1271_commands {
         CMD_SMART_CONFIG_STOP           = 62,
         CMD_SMART_CONFIG_SET_GROUP_KEY  = 63,
 
+        CMD_CAC_START                   = 64,
+        CMD_CAC_STOP                    = 65,
+        CMD_DFS_MASTER_RESTART          = 66,
+        CMD_DFS_RADAR_DETECTION_DEBUG   = 67,
+
         MAX_COMMAND_ID = 0xFFFF,
 };
 
@@ -642,6 +648,8 @@ struct wl12xx_cmd_regdomain_dfs_config {
 
         __le32 ch_bit_map1;
         __le32 ch_bit_map2;
+        u8 dfs_region;
+        u8 padding[3];
 } __packed;
 
 struct wl12xx_cmd_config_fwlog {
diff --git a/drivers/net/wireless/ti/wlcore/conf.h b/drivers/net/wireless/ti/wlcore/conf.h
index 40995c42bef8..166add00b50f 100644
--- a/drivers/net/wireless/ti/wlcore/conf.h
+++ b/drivers/net/wireless/ti/wlcore/conf.h
@@ -997,6 +997,11 @@ struct conf_conn_settings {
          * whether we can go to ELP.
          */
         u8 sta_sleep_auth;
+
+        /*
+         * Default RX BA Activity filter configuration
+         */
+        u8 suspend_rx_ba_activity;
 } __packed;
 
 enum {
@@ -1347,7 +1352,7 @@ struct conf_recovery_settings {
  * version, the two LSB are the lower driver's private conf
  * version.
  */
-#define WLCORE_CONF_VERSION     (0x0005 << 16)
+#define WLCORE_CONF_VERSION     (0x0006 << 16)
 #define WLCORE_CONF_MASK        0xffff0000
 #define WLCORE_CONF_SIZE        (sizeof(struct wlcore_conf_header) +    \
                                  sizeof(struct wlcore_conf))
diff --git a/drivers/net/wireless/ti/wlcore/debugfs.c b/drivers/net/wireless/ti/wlcore/debugfs.c
index 0be21f62fcb0..68f3bf229b5a 100644
--- a/drivers/net/wireless/ti/wlcore/debugfs.c
+++ b/drivers/net/wireless/ti/wlcore/debugfs.c
@@ -929,17 +929,10 @@ static ssize_t beacon_filtering_write(struct file *file,
 {
         struct wl1271 *wl = file->private_data;
         struct wl12xx_vif *wlvif;
-        char buf[10];
-        size_t len;
         unsigned long value;
         int ret;
 
-        len = min(count, sizeof(buf) - 1);
-        if (copy_from_user(buf, user_buf, len))
-                return -EFAULT;
-        buf[len] = '\0';
-
-        ret = kstrtoul(buf, 0, &value);
+        ret = kstrtoul_from_user(user_buf, count, 0, &value);
         if (ret < 0) {
                 wl1271_warning("illegal value for beacon_filtering!");
                 return -EINVAL;
diff --git a/drivers/net/wireless/ti/wlcore/event.c b/drivers/net/wireless/ti/wlcore/event.c
index 5153640f4532..c42e78955e7b 100644
--- a/drivers/net/wireless/ti/wlcore/event.c
+++ b/drivers/net/wireless/ti/wlcore/event.c
@@ -139,7 +139,7 @@ void wlcore_event_channel_switch(struct wl1271 *wl,
         wl1271_debug(DEBUG_EVENT, "%s: roles=0x%lx success=%d",
                      __func__, roles_bitmap, success);
 
-        wl12xx_for_each_wlvif_sta(wl, wlvif) {
+        wl12xx_for_each_wlvif(wl, wlvif) {
                 if (wlvif->role_id == WL12XX_INVALID_ROLE_ID ||
                     !test_bit(wlvif->role_id , &roles_bitmap))
                         continue;
@@ -150,8 +150,13 @@ void wlcore_event_channel_switch(struct wl1271 *wl,
 
                 vif = wl12xx_wlvif_to_vif(wlvif);
 
-                ieee80211_chswitch_done(vif, success);
-                cancel_delayed_work(&wlvif->channel_switch_work);
+                if (wlvif->bss_type == BSS_TYPE_STA_BSS) {
+                        ieee80211_chswitch_done(vif, success);
+                        cancel_delayed_work(&wlvif->channel_switch_work);
+                } else {
+                        set_bit(WLVIF_FLAG_BEACON_DISABLED, &wlvif->flags);
+                        ieee80211_csa_finish(vif);
+                }
         }
 }
 EXPORT_SYMBOL_GPL(wlcore_event_channel_switch);
diff --git a/drivers/net/wireless/ti/wlcore/hw_ops.h b/drivers/net/wireless/ti/wlcore/hw_ops.h
index aa9f82c72296..eec56935b1b6 100644
--- a/drivers/net/wireless/ti/wlcore/hw_ops.h
+++ b/drivers/net/wireless/ti/wlcore/hw_ops.h
@@ -211,11 +211,35 @@ wlcore_hw_pre_pkt_send(struct wl1271 *wl, u32 buf_offset, u32 last_len)
 }
 
 static inline void
-wlcore_hw_sta_rc_update(struct wl1271 *wl, struct wl12xx_vif *wlvif,
-                        struct ieee80211_sta *sta, u32 changed)
+wlcore_hw_sta_rc_update(struct wl1271 *wl, struct wl12xx_vif *wlvif)
 {
         if (wl->ops->sta_rc_update)
-                wl->ops->sta_rc_update(wl, wlvif, sta, changed);
+                wl->ops->sta_rc_update(wl, wlvif);
+}
+
+static inline int
+wlcore_hw_interrupt_notify(struct wl1271 *wl, bool action)
+{
+        if (wl->ops->interrupt_notify)
+                return wl->ops->interrupt_notify(wl, action);
+        return 0;
+}
+
+static inline int
+wlcore_hw_rx_ba_filter(struct wl1271 *wl, bool action)
+{
+        if (wl->ops->rx_ba_filter)
+                return wl->ops->rx_ba_filter(wl, action);
+        return 0;
+}
+
+static inline int
+wlcore_hw_ap_sleep(struct wl1271 *wl)
+{
+        if (wl->ops->ap_sleep)
+                return wl->ops->ap_sleep(wl);
+
+        return 0;
 }
 
 static inline int
@@ -287,4 +311,22 @@ wlcore_smart_config_set_group_key(struct wl1271 *wl, u16 group_id,
 
         return wl->ops->smart_config_set_group_key(wl, group_id, key_len, key);
 }
+
+static inline int
+wlcore_hw_set_cac(struct wl1271 *wl, struct wl12xx_vif *wlvif, bool start)
+{
+        if (!wl->ops->set_cac)
+                return -EINVAL;
+
+        return wl->ops->set_cac(wl, wlvif, start);
+}
+
+static inline int
+wlcore_hw_dfs_master_restart(struct wl1271 *wl, struct wl12xx_vif *wlvif)
+{
+        if (!wl->ops->dfs_master_restart)
+                return -EINVAL;
+
+        return wl->ops->dfs_master_restart(wl, wlvif);
+}
 #endif
diff --git a/drivers/net/wireless/ti/wlcore/init.c b/drivers/net/wireless/ti/wlcore/init.c
index 199e94120864..5ca1fb161a50 100644
--- a/drivers/net/wireless/ti/wlcore/init.c
+++ b/drivers/net/wireless/ti/wlcore/init.c
@@ -392,6 +392,11 @@ static int wl1271_ap_hw_init(struct wl1271 *wl, struct wl12xx_vif *wlvif)
         if (ret < 0)
                 return ret;
 
+        /* configure AP sleep, if enabled */
+        ret = wlcore_hw_ap_sleep(wl);
+        if (ret < 0)
+                return ret;
+
         return 0;
 }
 
@@ -567,8 +572,7 @@ int wl1271_init_vif_specific(struct wl1271 *wl, struct ieee80211_vif *vif)
         /* consider all existing roles before configuring psm. */
 
         if (wl->ap_count == 0 && is_ap) { /* first AP */
-                /* Configure for power always on */
-                ret = wl1271_acx_sleep_auth(wl, WL1271_PSM_CAM);
+                ret = wl1271_acx_sleep_auth(wl, WL1271_PSM_ELP);
                 if (ret < 0)
                         return ret;
 
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index 6ad3fcedab9b..1e136993580f 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -79,22 +79,12 @@ static int wl12xx_set_authorized(struct wl1271 *wl, struct wl12xx_vif *wlvif)
 static void wl1271_reg_notify(struct wiphy *wiphy,
                               struct regulatory_request *request)
 {
-        struct ieee80211_supported_band *band;
-        struct ieee80211_channel *ch;
-        int i;
         struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
         struct wl1271 *wl = hw->priv;
 
-        band = wiphy->bands[IEEE80211_BAND_5GHZ];
-        for (i = 0; i < band->n_channels; i++) {
-                ch = &band->channels[i];
-                if (ch->flags & IEEE80211_CHAN_DISABLED)
-                        continue;
-
-                if (ch->flags & IEEE80211_CHAN_RADAR)
-                        ch->flags |= IEEE80211_CHAN_NO_IR;
-
-        }
+        /* copy the current dfs region */
+        if (request)
+                wl->dfs_region = request->dfs_region;
 
         wlcore_regdomain_config(wl);
 }
@@ -226,6 +216,29 @@ void wl12xx_rearm_tx_watchdog_locked(struct wl1271 *wl)
                 msecs_to_jiffies(wl->conf.tx.tx_watchdog_timeout));
 }
 
+static void wlcore_rc_update_work(struct work_struct *work)
+{
+        int ret;
+        struct wl12xx_vif *wlvif = container_of(work, struct wl12xx_vif,
+                                                rc_update_work);
+        struct wl1271 *wl = wlvif->wl;
+
+        mutex_lock(&wl->mutex);
+
+        if (unlikely(wl->state != WLCORE_STATE_ON))
+                goto out;
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
+        wlcore_hw_sta_rc_update(wl, wlvif);
+
+        wl1271_ps_elp_sleep(wl);
+out:
+        mutex_unlock(&wl->mutex);
+}
+
 static void wl12xx_tx_watchdog_work(struct work_struct *work)
 {
         struct delayed_work *dwork;
@@ -1662,19 +1675,15 @@ static int wl1271_configure_suspend_sta(struct wl1271 *wl,
         if (!test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags))
                 goto out;
 
-        ret = wl1271_ps_elp_wakeup(wl);
-        if (ret < 0)
-                goto out;
-
         ret = wl1271_configure_wowlan(wl, wow);
         if (ret < 0)
-                goto out_sleep;
+                goto out;
 
         if ((wl->conf.conn.suspend_wake_up_event ==
              wl->conf.conn.wake_up_event) &&
             (wl->conf.conn.suspend_listen_interval ==
              wl->conf.conn.listen_interval))
-                goto out_sleep;
+                goto out;
 
         ret = wl1271_acx_wake_up_conditions(wl, wlvif,
                                     wl->conf.conn.suspend_wake_up_event,
@@ -1682,29 +1691,28 @@ static int wl1271_configure_suspend_sta(struct wl1271 *wl,
 
         if (ret < 0)
                 wl1271_error("suspend: set wake up conditions failed: %d", ret);
-
-out_sleep:
-        wl1271_ps_elp_sleep(wl);
 out:
         return ret;
 
 }
 
 static int wl1271_configure_suspend_ap(struct wl1271 *wl,
-                                       struct wl12xx_vif *wlvif)
+                                        struct wl12xx_vif *wlvif,
+                                        struct cfg80211_wowlan *wow)
 {
         int ret = 0;
 
         if (!test_bit(WLVIF_FLAG_AP_STARTED, &wlvif->flags))
                 goto out;
 
-        ret = wl1271_ps_elp_wakeup(wl);
+        ret = wl1271_acx_beacon_filter_opt(wl, wlvif, true);
         if (ret < 0)
                 goto out;
 
-        ret = wl1271_acx_beacon_filter_opt(wl, wlvif, true);
+        ret = wl1271_configure_wowlan(wl, wow);
+        if (ret < 0)
+                goto out;
 
-        wl1271_ps_elp_sleep(wl);
 out:
         return ret;
 
@@ -1717,7 +1725,7 @@ static int wl1271_configure_suspend(struct wl1271 *wl,
         if (wlvif->bss_type == BSS_TYPE_STA_BSS)
                 return wl1271_configure_suspend_sta(wl, wlvif, wow);
         if (wlvif->bss_type == BSS_TYPE_AP_BSS)
-                return wl1271_configure_suspend_ap(wl, wlvif);
+                return wl1271_configure_suspend_ap(wl, wlvif, wow);
         return 0;
 }
 
@@ -1730,21 +1738,18 @@ static void wl1271_configure_resume(struct wl1271 *wl, struct wl12xx_vif *wlvif)
         if ((!is_ap) && (!is_sta))
                 return;
 
-        if (is_sta && !test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags))
+        if ((is_sta && !test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags)) ||
+            (is_ap && !test_bit(WLVIF_FLAG_AP_STARTED, &wlvif->flags)))
                 return;
 
-        ret = wl1271_ps_elp_wakeup(wl);
-        if (ret < 0)
-                return;
+        wl1271_configure_wowlan(wl, NULL);
 
         if (is_sta) {
-                wl1271_configure_wowlan(wl, NULL);
-
                 if ((wl->conf.conn.suspend_wake_up_event ==
                      wl->conf.conn.wake_up_event) &&
                     (wl->conf.conn.suspend_listen_interval ==
                      wl->conf.conn.listen_interval))
-                        goto out_sleep;
+                        return;
 
                 ret = wl1271_acx_wake_up_conditions(wl, wlvif,
                                     wl->conf.conn.wake_up_event,
@@ -1757,9 +1762,6 @@ static void wl1271_configure_resume(struct wl1271 *wl, struct wl12xx_vif *wlvif)
         } else if (is_ap) {
                 ret = wl1271_acx_beacon_filter_opt(wl, wlvif, false);
         }
-
-out_sleep:
-        wl1271_ps_elp_sleep(wl);
 }
 
 static int wl1271_op_suspend(struct ieee80211_hw *hw,
@@ -1781,6 +1783,13 @@ static int wl1271_op_suspend(struct ieee80211_hw *hw,
         wl1271_tx_flush(wl);
 
         mutex_lock(&wl->mutex);
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0) {
+                mutex_unlock(&wl->mutex);
+                return ret;
+        }
+
         wl->wow_enabled = true;
         wl12xx_for_each_wlvif(wl, wlvif) {
                 ret = wl1271_configure_suspend(wl, wlvif, wow);
@@ -1790,7 +1799,27 @@ static int wl1271_op_suspend(struct ieee80211_hw *hw,
                         return ret;
                 }
         }
+
+        /* disable fast link flow control notifications from FW */
+        ret = wlcore_hw_interrupt_notify(wl, false);
+        if (ret < 0)
+                goto out_sleep;
+
+        /* if filtering is enabled, configure the FW to drop all RX BA frames */
+        ret = wlcore_hw_rx_ba_filter(wl,
+                                     !!wl->conf.conn.suspend_rx_ba_activity);
+        if (ret < 0)
+                goto out_sleep;
+
+out_sleep:
+        wl1271_ps_elp_sleep(wl);
         mutex_unlock(&wl->mutex);
+
+        if (ret < 0) {
+                wl1271_warning("couldn't prepare device to suspend");
+                return ret;
+        }
+
         /* flush any remaining work */
         wl1271_debug(DEBUG_MAC80211, "flushing remaining works");
 
@@ -1864,13 +1893,29 @@ static int wl1271_op_resume(struct ieee80211_hw *hw)
         if (pending_recovery) {
                 wl1271_warning("queuing forgotten recovery on resume");
                 ieee80211_queue_work(wl->hw, &wl->recovery_work);
-                goto out;
+                goto out_sleep;
         }
 
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
         wl12xx_for_each_wlvif(wl, wlvif) {
                 wl1271_configure_resume(wl, wlvif);
         }
 
+        ret = wlcore_hw_interrupt_notify(wl, true);
+        if (ret < 0)
+                goto out_sleep;
+
+        /* if filtering is enabled, configure the FW to drop all RX BA frames */
+        ret = wlcore_hw_rx_ba_filter(wl, false);
+        if (ret < 0)
+                goto out_sleep;
+
+out_sleep:
+        wl1271_ps_elp_sleep(wl);
+
 out:
         wl->wow_enabled = false;
 
@@ -2279,6 +2324,7 @@ static int wl12xx_init_vif_data(struct wl1271 *wl, struct ieee80211_vif *vif)
                   wl1271_rx_streaming_enable_work);
         INIT_WORK(&wlvif->rx_streaming_disable_work,
                   wl1271_rx_streaming_disable_work);
+        INIT_WORK(&wlvif->rc_update_work, wlcore_rc_update_work);
         INIT_DELAYED_WORK(&wlvif->channel_switch_work,
                           wlcore_channel_switch_work);
         INIT_DELAYED_WORK(&wlvif->connection_loss_work,
@@ -2508,6 +2554,7 @@ static int wl1271_op_add_interface(struct ieee80211_hw *hw,
         }
 
         vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER |
+                             IEEE80211_VIF_SUPPORTS_UAPSD |
                              IEEE80211_VIF_SUPPORTS_CQM_RSSI;
 
         wl1271_debug(DEBUG_MAC80211, "mac80211 add interface type %d mac %pM",
@@ -2723,6 +2770,7 @@ unlock:
         del_timer_sync(&wlvif->rx_streaming_timer);
         cancel_work_sync(&wlvif->rx_streaming_enable_work);
         cancel_work_sync(&wlvif->rx_streaming_disable_work);
+        cancel_work_sync(&wlvif->rc_update_work);
         cancel_delayed_work_sync(&wlvif->connection_loss_work);
         cancel_delayed_work_sync(&wlvif->channel_switch_work);
         cancel_delayed_work_sync(&wlvif->pending_auth_complete_work);
@@ -4072,8 +4120,14 @@ static int wl1271_bss_beacon_info_changed(struct wl1271 *wl,
                 ret = wlcore_set_beacon_template(wl, vif, is_ap);
                 if (ret < 0)
                         goto out;
-        }
 
+                if (test_and_clear_bit(WLVIF_FLAG_BEACON_DISABLED,
+                                       &wlvif->flags)) {
+                        ret = wlcore_hw_dfs_master_restart(wl, wlvif);
+                        if (ret < 0)
+                                goto out;
+                }
+        }
 out:
         if (ret != 0)
                 wl1271_error("beacon info change failed: %d", ret);
@@ -4574,10 +4628,46 @@ static void wlcore_op_change_chanctx(struct ieee80211_hw *hw,
                                      struct ieee80211_chanctx_conf *ctx,
                                      u32 changed)
 {
+        struct wl1271 *wl = hw->priv;
+        struct wl12xx_vif *wlvif;
+        int ret;
+        int channel = ieee80211_frequency_to_channel(
+                ctx->def.chan->center_freq);
+
         wl1271_debug(DEBUG_MAC80211,
                      "mac80211 change chanctx %d (type %d) changed 0x%x",
-                     ieee80211_frequency_to_channel(ctx->def.chan->center_freq),
-                     cfg80211_get_chandef_type(&ctx->def), changed);
+                     channel, cfg80211_get_chandef_type(&ctx->def), changed);
+
+        mutex_lock(&wl->mutex);
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
+        wl12xx_for_each_wlvif(wl, wlvif) {
+                struct ieee80211_vif *vif = wl12xx_wlvif_to_vif(wlvif);
+
+                rcu_read_lock();
+                if (rcu_access_pointer(vif->chanctx_conf) != ctx) {
+                        rcu_read_unlock();
+                        continue;
+                }
+                rcu_read_unlock();
+
+                /* start radar if needed */
+                if (changed & IEEE80211_CHANCTX_CHANGE_RADAR &&
+                    wlvif->bss_type == BSS_TYPE_AP_BSS &&
+                    ctx->radar_enabled && !wlvif->radar_enabled &&
+                    ctx->def.chan->dfs_state == NL80211_DFS_USABLE) {
+                        wl1271_debug(DEBUG_MAC80211, "Start radar detection");
+                        wlcore_hw_set_cac(wl, wlvif, true);
+                        wlvif->radar_enabled = true;
+                }
+        }
+
+        wl1271_ps_elp_sleep(wl);
+out:
+        mutex_unlock(&wl->mutex);
 }
 
 static int wlcore_op_assign_vif_chanctx(struct ieee80211_hw *hw,
@@ -4588,13 +4678,26 @@ static int wlcore_op_assign_vif_chanctx(struct ieee80211_hw *hw,
         struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
         int channel = ieee80211_frequency_to_channel(
                 ctx->def.chan->center_freq);
+        int ret = -EINVAL;
 
         wl1271_debug(DEBUG_MAC80211,
-                     "mac80211 assign chanctx (role %d) %d (type %d)",
-                     wlvif->role_id, channel, cfg80211_get_chandef_type(&ctx->def));
+                     "mac80211 assign chanctx (role %d) %d (type %d) (radar %d dfs_state %d)",
+                     wlvif->role_id, channel,
+                     cfg80211_get_chandef_type(&ctx->def),
+                     ctx->radar_enabled, ctx->def.chan->dfs_state);
 
         mutex_lock(&wl->mutex);
 
+        if (unlikely(wl->state != WLCORE_STATE_ON))
+                goto out;
+
+        if (unlikely(!test_bit(WLVIF_FLAG_INITIALIZED, &wlvif->flags)))
+                goto out;
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
         wlvif->band = ctx->def.chan->band;
         wlvif->channel = channel;
         wlvif->channel_type = cfg80211_get_chandef_type(&ctx->def);
@@ -4602,6 +4705,15 @@ static int wlcore_op_assign_vif_chanctx(struct ieee80211_hw *hw,
         /* update default rates according to the band */
         wl1271_set_band_rate(wl, wlvif);
 
+        if (ctx->radar_enabled &&
+            ctx->def.chan->dfs_state == NL80211_DFS_USABLE) {
+                wl1271_debug(DEBUG_MAC80211, "Start radar detection");
+                wlcore_hw_set_cac(wl, wlvif, true);
+                wlvif->radar_enabled = true;
+        }
+
+        wl1271_ps_elp_sleep(wl);
+out:
         mutex_unlock(&wl->mutex);
 
         return 0;
@@ -4613,6 +4725,7 @@ static void wlcore_op_unassign_vif_chanctx(struct ieee80211_hw *hw,
 {
         struct wl1271 *wl = hw->priv;
         struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
+        int ret;
 
         wl1271_debug(DEBUG_MAC80211,
                      "mac80211 unassign chanctx (role %d) %d (type %d)",
@@ -4621,6 +4734,99 @@ static void wlcore_op_unassign_vif_chanctx(struct ieee80211_hw *hw,
                      cfg80211_get_chandef_type(&ctx->def));
 
         wl1271_tx_flush(wl);
+
+        mutex_lock(&wl->mutex);
+
+        if (unlikely(wl->state != WLCORE_STATE_ON))
+                goto out;
+
+        if (unlikely(!test_bit(WLVIF_FLAG_INITIALIZED, &wlvif->flags)))
+                goto out;
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
+        if (wlvif->radar_enabled) {
+                wl1271_debug(DEBUG_MAC80211, "Stop radar detection");
+                wlcore_hw_set_cac(wl, wlvif, false);
+                wlvif->radar_enabled = false;
+        }
+
+        wl1271_ps_elp_sleep(wl);
+out:
+        mutex_unlock(&wl->mutex);
+}
+
+static int __wlcore_switch_vif_chan(struct wl1271 *wl,
+                                    struct wl12xx_vif *wlvif,
+                                    struct ieee80211_chanctx_conf *new_ctx)
+{
+        int channel = ieee80211_frequency_to_channel(
+                new_ctx->def.chan->center_freq);
+
+        wl1271_debug(DEBUG_MAC80211,
+                     "switch vif (role %d) %d -> %d chan_type: %d",
+                     wlvif->role_id, wlvif->channel, channel,
+                     cfg80211_get_chandef_type(&new_ctx->def));
+
+        if (WARN_ON_ONCE(wlvif->bss_type != BSS_TYPE_AP_BSS))
+                return 0;
+
+        WARN_ON(!test_bit(WLVIF_FLAG_BEACON_DISABLED, &wlvif->flags));
+
+        if (wlvif->radar_enabled) {
+                wl1271_debug(DEBUG_MAC80211, "Stop radar detection");
+                wlcore_hw_set_cac(wl, wlvif, false);
+                wlvif->radar_enabled = false;
+        }
+
+        wlvif->band = new_ctx->def.chan->band;
+        wlvif->channel = channel;
+        wlvif->channel_type = cfg80211_get_chandef_type(&new_ctx->def);
+
+        /* start radar if needed */
+        if (new_ctx->radar_enabled) {
+                wl1271_debug(DEBUG_MAC80211, "Start radar detection");
+                wlcore_hw_set_cac(wl, wlvif, true);
+                wlvif->radar_enabled = true;
+        }
+
+        return 0;
+}
+
+static int
+wlcore_op_switch_vif_chanctx(struct ieee80211_hw *hw,
+                             struct ieee80211_vif_chanctx_switch *vifs,
+                             int n_vifs,
+                             enum ieee80211_chanctx_switch_mode mode)
+{
+        struct wl1271 *wl = hw->priv;
+        int i, ret;
+
+        wl1271_debug(DEBUG_MAC80211,
+                     "mac80211 switch chanctx n_vifs %d mode %d",
+                     n_vifs, mode);
+
+        mutex_lock(&wl->mutex);
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
+        for (i = 0; i < n_vifs; i++) {
+                struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vifs[i].vif);
+
+                ret = __wlcore_switch_vif_chan(wl, wlvif, vifs[i].new_ctx);
+                if (ret)
+                        goto out_sleep;
+        }
+out_sleep:
+        wl1271_ps_elp_sleep(wl);
+out:
+        mutex_unlock(&wl->mutex);
+
+        return 0;
 }
 
 static int wl1271_op_conf_tx(struct ieee80211_hw *hw,
@@ -5228,6 +5434,83 @@ out:
         mutex_unlock(&wl->mutex);
 }
 
+static const void *wlcore_get_beacon_ie(struct wl1271 *wl,
+                                        struct wl12xx_vif *wlvif,
+                                        u8 eid)
+{
+        int ieoffset = offsetof(struct ieee80211_mgmt, u.beacon.variable);
+        struct sk_buff *beacon =
+                ieee80211_beacon_get(wl->hw, wl12xx_wlvif_to_vif(wlvif));
+
+        if (!beacon)
+                return NULL;
+
+        return cfg80211_find_ie(eid,
+                                beacon->data + ieoffset,
+                                beacon->len - ieoffset);
+}
+
+static int wlcore_get_csa_count(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                                u8 *csa_count)
+{
+        const u8 *ie;
+        const struct ieee80211_channel_sw_ie *ie_csa;
+
+        ie = wlcore_get_beacon_ie(wl, wlvif, WLAN_EID_CHANNEL_SWITCH);
+        if (!ie)
+                return -EINVAL;
+
+        ie_csa = (struct ieee80211_channel_sw_ie *)&ie[2];
+        *csa_count = ie_csa->count;
+
+        return 0;
+}
+
+static void wlcore_op_channel_switch_beacon(struct ieee80211_hw *hw,
+                                            struct ieee80211_vif *vif,
+                                            struct cfg80211_chan_def *chandef)
+{
+        struct wl1271 *wl = hw->priv;
+        struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
+        struct ieee80211_channel_switch ch_switch = {
+                .block_tx = true,
+                .chandef = *chandef,
+        };
+        int ret;
+
+        wl1271_debug(DEBUG_MAC80211,
+                     "mac80211 channel switch beacon (role %d)",
+                     wlvif->role_id);
+
+        ret = wlcore_get_csa_count(wl, wlvif, &ch_switch.count);
+        if (ret < 0) {
+                wl1271_error("error getting beacon (for CSA counter)");
+                return;
+        }
+
+        mutex_lock(&wl->mutex);
+
+        if (unlikely(wl->state != WLCORE_STATE_ON)) {
+                ret = -EBUSY;
+                goto out;
+        }
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
+        ret = wl->ops->channel_switch(wl, wlvif, &ch_switch);
+        if (ret)
+                goto out_sleep;
+
+        set_bit(WLVIF_FLAG_CS_PROGRESS, &wlvif->flags);
+
+out_sleep:
+        wl1271_ps_elp_sleep(wl);
+out:
+        mutex_unlock(&wl->mutex);
+}
+
 static void wlcore_op_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                             u32 queues, bool drop)
 {
@@ -5370,19 +5653,26 @@ static void wlcore_op_sta_rc_update(struct ieee80211_hw *hw,
                                     u32 changed)
 {
         struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
-        struct wl1271 *wl = hw->priv;
 
-        wlcore_hw_sta_rc_update(wl, wlvif, sta, changed);
+        wl1271_debug(DEBUG_MAC80211, "mac80211 sta_rc_update");
+
+        if (!(changed & IEEE80211_RC_BW_CHANGED))
+                return;
+
+        /* this callback is atomic, so schedule a new work */
+        wlvif->rc_update_bw = sta->bandwidth;
+        ieee80211_queue_work(hw, &wlvif->rc_update_work);
 }
 
-static int wlcore_op_get_rssi(struct ieee80211_hw *hw,
-                               struct ieee80211_vif *vif,
-                               struct ieee80211_sta *sta,
-                               s8 *rssi_dbm)
+static void wlcore_op_sta_statistics(struct ieee80211_hw *hw,
+                                     struct ieee80211_vif *vif,
+                                     struct ieee80211_sta *sta,
+                                     struct station_info *sinfo)
 {
         struct wl1271 *wl = hw->priv;
         struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
-        int ret = 0;
+        s8 rssi_dbm;
+        int ret;
 
         wl1271_debug(DEBUG_MAC80211, "mac80211 get_rssi");
 
@@ -5395,17 +5685,18 @@ static int wlcore_op_get_rssi(struct ieee80211_hw *hw,
         if (ret < 0)
                 goto out_sleep;
 
-        ret = wlcore_acx_average_rssi(wl, wlvif, rssi_dbm);
+        ret = wlcore_acx_average_rssi(wl, wlvif, &rssi_dbm);
         if (ret < 0)
                 goto out_sleep;
 
+        sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
+        sinfo->signal = rssi_dbm;
+
 out_sleep:
         wl1271_ps_elp_sleep(wl);
 
 out:
         mutex_unlock(&wl->mutex);
-
-        return ret;
 }
 
 static bool wl1271_tx_frames_pending(struct ieee80211_hw *hw)
@@ -5596,6 +5887,7 @@ static const struct ieee80211_ops wl1271_ops = {
         .set_bitrate_mask = wl12xx_set_bitrate_mask,
         .set_default_unicast_key = wl1271_op_set_default_key_idx,
         .channel_switch = wl12xx_op_channel_switch,
+        .channel_switch_beacon = wlcore_op_channel_switch_beacon,
         .flush = wlcore_op_flush,
         .remain_on_channel = wlcore_op_remain_on_channel,
         .cancel_remain_on_channel = wlcore_op_cancel_remain_on_channel,
@@ -5604,8 +5896,9 @@ static const struct ieee80211_ops wl1271_ops = {
         .change_chanctx = wlcore_op_change_chanctx,
         .assign_vif_chanctx = wlcore_op_assign_vif_chanctx,
         .unassign_vif_chanctx = wlcore_op_unassign_vif_chanctx,
+        .switch_vif_chanctx = wlcore_op_switch_vif_chanctx,
         .sta_rc_update = wlcore_op_sta_rc_update,
-        .get_rssi = wlcore_op_get_rssi,
+        .sta_statistics = wlcore_op_sta_statistics,
         CFG80211_TESTMODE_CMD(wl1271_tm_cmd)
 };
 
@@ -5776,7 +6069,6 @@ static int wl1271_init_ieee80211(struct wl1271 *wl)
         wl->hw->flags = IEEE80211_HW_SIGNAL_DBM |
                 IEEE80211_HW_SUPPORTS_PS |
                 IEEE80211_HW_SUPPORTS_DYNAMIC_PS |
-                IEEE80211_HW_SUPPORTS_UAPSD |
                 IEEE80211_HW_HAS_RATE_CONTROL |
                 IEEE80211_HW_CONNECTION_MONITOR |
                 IEEE80211_HW_REPORTS_TX_ACK_STATUS |
@@ -5811,7 +6103,8 @@ static int wl1271_init_ieee80211(struct wl1271 *wl)
 
         wl->hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD |
                                 WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
-                                WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
+                                WIPHY_FLAG_SUPPORTS_SCHED_SCAN |
+                                WIPHY_FLAG_HAS_CHANNEL_SWITCH;
 
         /* make sure all our channels fit in the scanned_ch bitmask */
         BUILD_BUG_ON(ARRAY_SIZE(wl1271_channels) +
diff --git a/drivers/net/wireless/ti/wlcore/ps.c b/drivers/net/wireless/ti/wlcore/ps.c
index b52516eed7b2..4cd316e61466 100644
--- a/drivers/net/wireless/ti/wlcore/ps.c
+++ b/drivers/net/wireless/ti/wlcore/ps.c
@@ -56,9 +56,6 @@ void wl1271_elp_work(struct work_struct *work)
                 goto out;
 
         wl12xx_for_each_wlvif(wl, wlvif) {
-                if (wlvif->bss_type == BSS_TYPE_AP_BSS)
-                        goto out;
-
                 if (!test_bit(WLVIF_FLAG_IN_PS, &wlvif->flags) &&
                     test_bit(WLVIF_FLAG_IN_USE, &wlvif->flags))
                         goto out;
@@ -95,9 +92,6 @@ void wl1271_ps_elp_sleep(struct wl1271 *wl)
                 return;
 
         wl12xx_for_each_wlvif(wl, wlvif) {
-                if (wlvif->bss_type == BSS_TYPE_AP_BSS)
-                        return;
-
                 if (!test_bit(WLVIF_FLAG_IN_PS, &wlvif->flags) &&
                     test_bit(WLVIF_FLAG_IN_USE, &wlvif->flags))
                         return;
@@ -108,6 +102,7 @@ void wl1271_ps_elp_sleep(struct wl1271 *wl)
         ieee80211_queue_delayed_work(wl->hw, &wl->elp_work,
                                      msecs_to_jiffies(timeout));
 }
+EXPORT_SYMBOL_GPL(wl1271_ps_elp_sleep);
 
 int wl1271_ps_elp_wakeup(struct wl1271 *wl)
 {
@@ -175,6 +170,7 @@ err:
 out:
         return 0;
 }
+EXPORT_SYMBOL_GPL(wl1271_ps_elp_wakeup);
 
 int wl1271_ps_set_mode(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                        enum wl1271_cmd_ps_mode mode)
diff --git a/drivers/net/wireless/ti/wlcore/vendor_cmd.c b/drivers/net/wireless/ti/wlcore/vendor_cmd.c
index ad86a48dcfcb..fd4e9ba176c9 100644
--- a/drivers/net/wireless/ti/wlcore/vendor_cmd.c
+++ b/drivers/net/wireless/ti/wlcore/vendor_cmd.c
@@ -21,7 +21,7 @@ static const
 struct nla_policy wlcore_vendor_attr_policy[NUM_WLCORE_VENDOR_ATTR] = {
         [WLCORE_VENDOR_ATTR_FREQ]               = { .type = NLA_U32 },
         [WLCORE_VENDOR_ATTR_GROUP_ID]           = { .type = NLA_U32 },
-        [WLCORE_VENDOR_ATTR_GROUP_KEY]          = { .type = NLA_U32,
+        [WLCORE_VENDOR_ATTR_GROUP_KEY]          = { .type = NLA_BINARY,
                                                     .len = WLAN_MAX_KEY_LEN },
 };
 
diff --git a/drivers/net/wireless/ti/wlcore/wlcore.h b/drivers/net/wireless/ti/wlcore/wlcore.h
index df78cf12ef15..d599c869e6e8 100644
--- a/drivers/net/wireless/ti/wlcore/wlcore.h
+++ b/drivers/net/wireless/ti/wlcore/wlcore.h
@@ -106,8 +106,7 @@ struct wlcore_ops {
                               struct wl12xx_vif *wlvif,
                               struct ieee80211_channel_switch *ch_switch);
         u32 (*pre_pkt_send)(struct wl1271 *wl, u32 buf_offset, u32 last_len);
-        void (*sta_rc_update)(struct wl1271 *wl, struct wl12xx_vif *wlvif,
-                              struct ieee80211_sta *sta, u32 changed);
+        void (*sta_rc_update)(struct wl1271 *wl, struct wl12xx_vif *wlvif);
         int (*set_peer_cap)(struct wl1271 *wl,
                             struct ieee80211_sta_ht_cap *ht_cap,
                             bool allow_ht_operation,
@@ -117,10 +116,16 @@ struct wlcore_ops {
                               struct wl1271_link *lnk);
         bool (*lnk_low_prio)(struct wl1271 *wl, u8 hlid,
                              struct wl1271_link *lnk);
+        int (*interrupt_notify)(struct wl1271 *wl, bool action);
+        int (*rx_ba_filter)(struct wl1271 *wl, bool action);
+        int (*ap_sleep)(struct wl1271 *wl);
         int (*smart_config_start)(struct wl1271 *wl, u32 group_bitmap);
         int (*smart_config_stop)(struct wl1271 *wl);
         int (*smart_config_set_group_key)(struct wl1271 *wl, u16 group_id,
                                           u8 key_len, u8 *key);
+        int (*set_cac)(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                       bool start);
+        int (*dfs_master_restart)(struct wl1271 *wl, struct wl12xx_vif *wlvif);
 };
 
 enum wlcore_partitions {
@@ -460,6 +465,9 @@ struct wl1271 {
         /* HW HT (11n) capabilities */
         struct ieee80211_sta_ht_cap ht_cap[WLCORE_NUM_BANDS];
 
+        /* the current dfs region */
+        enum nl80211_dfs_regions dfs_region;
+
         /* size of the private FW status data */
         size_t fw_status_len;
         size_t fw_status_priv_len;
diff --git a/drivers/net/wireless/ti/wlcore/wlcore_i.h b/drivers/net/wireless/ti/wlcore/wlcore_i.h
index 0e52556044d9..3396ce5a934d 100644
--- a/drivers/net/wireless/ti/wlcore/wlcore_i.h
+++ b/drivers/net/wireless/ti/wlcore/wlcore_i.h
@@ -251,6 +251,7 @@ enum wl12xx_vif_flags {
         WLVIF_FLAG_AP_PROBE_RESP_SET,
         WLVIF_FLAG_IN_USE,
         WLVIF_FLAG_ACTIVE,
+        WLVIF_FLAG_BEACON_DISABLED,
 };
 
 struct wl12xx_vif;
@@ -434,6 +435,8 @@ struct wl12xx_vif {
 
         bool wmm_enabled;
 
+        bool radar_enabled;
+
         /* Rx Streaming */
         struct work_struct rx_streaming_enable_work;
         struct work_struct rx_streaming_disable_work;
@@ -463,6 +466,10 @@ struct wl12xx_vif {
         /* work for canceling ROC after pending auth reply */
         struct delayed_work pending_auth_complete_work;
 
+        /* update rate conrol */
+        enum ieee80211_sta_rx_bandwidth rc_update_bw;
+        struct work_struct rc_update_work;
+
         /*
          * total freed FW packets on the link.
          * For STA this holds the PN of the link to the AP.